ISO/IEC FDIS 27091/Stage 50.00/Planning date 18 Feb 2027 estimate/ISO/IEC JTC 1/SC 27
27091ISO 27091 CheckerAI privacy, read from the rules that apply today
R5
Reference
Named, not stated

European Union: the instruments named

ISO/IEC FDIS 27091ReferenceNo new requirement

In the EU the GDPR sets the general privacy duty and the AI Act adds duties for certain AI systems. This page names them and does not state their text.

What this page covers

  • The General Data Protection Regulation 2016/679: lawful basis, purpose limitation, minimisation, the data protection impact assessment and the rights of the person.
  • The AI Act, Regulation (EU) 2024/1689: risk classes, transparency duties, and the data governance duties for systems that train on personal data.
  • National implementations and supervisory authority guidance on AI and profiling.
  • The GDPR's Article 22 on automated decisions, which reaches a model that decides about a person without meaningful human involvement.

How to use it

Record the GDPR basis and the AI Act class for each system. Where a data protection impact assessment is required, use it as the evaluation the draft describes.

What it does not add

This page does not state the GDPR or the AI Act and is not legal advice. The AI Act is being phased in; check the current application dates.

The 27091 record

The instruments are named only. The site does not reproduce either text.

Read across

Source for this reference page: European Union: the instruments named on the reference page, retrieved 22 October 2026. The note is limited to what the public record states. Every source.