EU AI Act vs. GDPR: How They Work Together

Two Regulations, One Compliance Challenge

If you handle AI governance in a European organization, you already know the General Data Protection Regulation (GDPR). Now, with the EU AI Act (Regulation 2024/1689), there is a second regulatory framework to contend with. The question on every DPO's mind: how do these two regulations fit together?

The short answer is that they are complementary, not competing. The AI Act explicitly states that it is "without prejudice" to GDPR (Article 2(7)), meaning both regulations apply simultaneously to AI systems that process personal data. You need to comply with both, but understanding where they overlap can save you real effort.

Key Differences in Scope and Approach

What They Regulate

GDPR regulates the processing of personal data. Its scope is determined by whether personal data is involved, regardless of the technology used. It applies to any organization processing personal data of EU residents.

The EU AI Act regulates AI systems themselves. Its scope is determined by the nature and risk level of the AI system, regardless of whether personal data is processed. An AI system processing only non-personal data can still be high-risk under the AI Act.

Risk Assessment Approaches

GDPR uses risk as a guiding principle throughout (data protection by design, DPIAs for high-risk processing) but does not define risk categories the way the AI Act does. The obligation to conduct a Data Protection Impact Assessment (DPIA) under Article 35 applies when processing is "likely to result in a high risk to the rights and freedoms of natural persons."

The EU AI Act defines explicit risk categories (prohibited, high-risk, limited, and minimal) with prescriptive obligations for each tier. Risk classification is based on the system's intended purpose and the sector in which it operates, following Articles 5, 6, 7, and Annex III.

Where They Overlap

Data Governance

Data governance is where the two frameworks converge most clearly. GDPR's principles of data minimization, purpose limitation, accuracy, and storage limitation (Article 5 GDPR) align closely with the AI Act's data governance requirements for high-risk systems (Article 10 AI Act). Both require documented data quality measures, relevant and representative training data, appropriate governance practices, and assessment of potential biases.

If you have robust GDPR data governance in place, you have a strong foundation for AI Act compliance. That said, the AI Act adds specific requirements around training, validation, and testing datasets that go beyond what GDPR demands.

Impact Assessments: DPIA vs. FRIA

GDPR requires a Data Protection Impact Assessment (DPIA) for high-risk processing (Article 35 GDPR). The AI Act requires a Fundamental Rights Impact Assessment (FRIA) for deployers of high-risk AI systems (Article 27 AI Act).

These assessments are related but not identical. The DPIA focuses on risks to data protection rights, covering privacy, data security, and data subject rights. The FRIA is broader: it covers fundamental rights including non-discrimination, freedom of expression, human dignity, access to justice, and other EU Charter rights.

For AI systems that process personal data (which is most of them), you will need both assessments. The practical upside is that there is considerable overlap in the data collection and analysis. A well-structured process can run both assessments in parallel, reusing information about the system, its data processing, and its potential impacts.

Article 27(4) of the AI Act explicitly states that where a DPIA has been carried out under GDPR, the FRIA "shall complement that assessment." The intent is clear: these assessments should work together, not create duplicate work.

Transparency and Information Rights

Both regulations require transparency, but from different angles.

GDPR requires informing data subjects about the processing of their personal data, including the existence of automated decision-making (Articles 13(2)(f) and 14(2)(g) GDPR) and meaningful information about the logic involved. The AI Act requires transparency about the AI system itself, such as disclosing that users are interacting with AI (Article 50) and providing deployers with instructions for use (Article 13).

GDPR Article 22 also provides the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. The AI Act's human oversight requirements (Article 14) operationalize this right by requiring meaningful human review capabilities.

Accountability and Documentation

GDPR's accountability principle (Article 5(2)) requires that controllers can demonstrate compliance. The AI Act similarly requires comprehensive documentation: Annex IV technical documentation, quality management systems, audit trails, and conformity assessments. Both regulations expect organizations to maintain thorough records and produce them upon request by authorities.

Where They Differ

Legal Basis

GDPR requires a legal basis for processing personal data (consent, contract, legitimate interest, etc.). The AI Act has no equivalent concept. It does not require a "legal basis" for deploying an AI system, but instead regulates the characteristics and governance of the system itself.

Individual Rights

GDPR grants individuals extensive rights: access, rectification, erasure, portability, restriction, and objection. The AI Act does not create equivalent individual rights. It protects individuals indirectly through system-level requirements (accuracy, robustness, human oversight) and through the FRIA requirement.

Enforcement Structure

GDPR is enforced by Data Protection Authorities (DPAs) in each Member State. The AI Act will be enforced by newly designated national competent authorities and market surveillance authorities, with the European AI Office coordinating at the EU level. In some Member States, these may be the same body as the DPA; in others, they will be separate.

Practical Guidance: Managing Both Regulations

Build an Integrated Governance Framework

Do not build separate compliance programs for GDPR and the AI Act. Create an integrated AI governance framework that addresses both. Your data protection team and your AI governance team should work together, or ideally be the same team with expanded responsibilities.

Combine Your Impact Assessments

Where an AI system processes personal data and is classified as high-risk, conduct DPIA and FRIA as a combined process. Start with the DPIA (which you may already be required to do), then extend it to cover the broader fundamental rights analysis required by the FRIA. Our platform's multi-framework risk mapping tool supports this workflow.

Unify Your Documentation

GDPR requires Records of Processing Activities (ROPA). The AI Act requires an AI system registry and Annex IV technical documentation. Structure your documentation to serve both purposes. A well-organized AI system registry that includes data processing details can satisfy requirements under both frameworks.

Leverage Your GDPR Investment

If your organization has mature GDPR compliance, you already have a head start on AI Act compliance. Your data governance practices, documentation habits, impact assessment methodology, and accountability culture all transfer directly. The gap is primarily in AI-specific technical requirements (risk management, accuracy, robustness) and the formal classification and conformity assessment process.

Watch for Regulatory Guidance

The European Data Protection Board (EDPB) and the European AI Office are expected to issue joint guidance on the relationship between GDPR and the AI Act. This will be especially important for clarifying how DPIAs and FRIAs should interact and how enforcement will be coordinated between DPAs and AI Act authorities.

What DPOs Should Do Now

If you are a Data Protection Officer, you are well positioned to lead your organization's AI Act compliance effort. A few concrete steps to consider:

• Map your AI systems against both GDPR processing records and AI Act risk categories
• Identify overlap between existing DPIAs and required FRIAs
• Extend your governance framework to include AI Act requirements
• Upskill your team on AI Act specifics, building on existing regulatory expertise
• Use integrated tooling that handles both frameworks simultaneously

Our DPO solution helps data protection professionals bridge GDPR and AI Act compliance. Try a free risk assessment to see where your AI systems fall under both frameworks.