Free penetration test
Free cloud & web-app pentest for qualified companies. SOC 2, HIPAA, PCI DSS-aligned report.
ApplyThe EU AI Act and the GDPR apply side by side. The GDPR governs any processing of personal data, including in AI training and prompts; the AI Act governs AI systems by risk, whether or not personal data is involved. The AI Act explicitly leaves the GDPR untouched, so an AI use involving personal data usually has to satisfy both.
Key takeaways
- The GDPR is triggered by personal data; the AI Act by placing on the market or using an AI system, scaled by risk.
- Roles differ: controller and processor under the GDPR; provider and deployer (among others) under the AI Act. One company can hold different roles under each.
- A DPIA (GDPR Article 35) and a fundamental rights impact assessment (AI Act Article 27) overlap; the AI Act lets the FRIA build on an existing DPIA.
- The Digital Omnibus replaced Article 10(5) with a new, wider Article 4a for processing special-category data to detect and correct bias, under strict necessity and safeguards.
- The cheapest route is one governance process: one inventory, one combined impact assessment, one set of vendor checks and one transparency review.
Why the two laws meet
Most AI that matters to a business touches people: a CV screening tool, a credit-scoring model, a customer-service chatbot, a Copilot rollout reading mailboxes. Each processes personal data, so the GDPR (Regulation (EU) 2016/679) applies. Each is also an AI system, so the AI Act (Regulation (EU) 2024/1689) applies too. Article 2(7) of the AI Act states that it does not affect the GDPR. Compliance with one never counts as compliance with the other.
The regulations have different logics. The GDPR is a rights-based law: it protects individuals' data wherever it is processed. The AI Act is a product-safety style law: it sets requirements for AI systems before and during use, graded by risk (summarised in how the EU AI Act works). Treating them as two separate projects doubles the work. Treating them as one does not. If you want a baseline before you start, Opsio's free EU AI Act readiness assessment asks about inventory, roles, data and vendors in one pass.
Need help with cloud?
Book a free 30-minute meeting with one of our cloud specialists. We'll analyse your situation and provide actionable recommendations — no obligation, no cost.
EU AI Act vs GDPR: side-by-side comparison
| Dimension | GDPR | EU AI Act |
|---|---|---|
| What it regulates | Processing of personal data | AI systems and general-purpose AI models |
| Trigger | Any processing of personal data in scope | Placing on the market, putting into service or using an AI system; duties scale with risk tier |
| Territorial reach | EU establishment, or offering goods/services to or monitoring people in the EU (Art. 3) | Providers placing AI on the EU market, and non-EU providers or deployers whose AI output is used in the EU (Art. 2) |
| Main roles | Controller, processor, joint controller | Provider, deployer, importer, distributor, product manufacturer, authorised representative |
| Risk assessment | DPIA for processing likely to result in high risk (Art. 35) | Risk management by providers of high-risk AI (Art. 9); FRIA by certain deployers (Art. 27) |
| Transparency | Information to data subjects (Arts. 13–14), including logic of automated decisions | Instructions for use (Art. 13); disclosure of chatbots, deepfakes and generated content (Art. 50); information to affected persons (Art. 26) |
| Individual rights | Access, rectification, erasure, objection, not to be subject to solely automated decisions (Art. 22) | Right to an explanation of individual decisions by certain high-risk AI (Art. 86); right to complain to a market surveillance authority (Art. 85) |
| Regulators | National data protection authorities; EDPB | National market surveillance authorities; AI Office for GPAI. Data protection authorities supervise some high-risk uses (Art. 74(8)) |
| Maximum fines | €20 million or 4% of worldwide turnover | €35 million or 7% for prohibited practices; €15 million or 3% for most other duties; €7.5 million or 1% for misleading information |
For businesses outside the EU, both laws reach across borders; the AI Act side is covered in does the EU AI Act apply to non-EU companies.
Where they overlap in practice
Personal data in training and inference
Training a model on personal data, sending personal data in a prompt, and generating outputs about identifiable people are all GDPR processing. You need a lawful basis, purpose limitation, data minimisation, retention rules and, where a vendor processes data for you, a data processing agreement. The AI Act adds data governance requirements for high-risk systems in Article 10: training, validation and test data must be relevant, sufficiently representative and, as far as possible, free of errors.
The European Data Protection Board's Opinion 28/2024 (December 2024) addressed when AI models can be considered anonymous and how legitimate interest can serve as a lawful basis for development and deployment. Expect data protection authorities to rely on it.
Special-category data for bias detection (Article 10(5))
Detecting bias often requires knowing protected characteristics, which are special-category data under GDPR Article 9. Article 4a of the AI Act, inserted by the Digital Omnibus (Regulation (EU) 2026/1744) to replace the former Article 10(5), provides a legal basis to process such data where strictly necessary for bias detection and correction, subject to safeguards such as pseudonymisation, strict access controls, no transfer to third parties and deletion once the bias is corrected. It covers providers and deployers of high-risk systems and, under conditions, other AI systems and models. Read the amended text before relying on it, and document the necessity test.
Automated decisions: GDPR Article 22 and the AI Act
GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, with narrow exceptions and safeguards such as human intervention. The AI Act approaches the same problem from the system side: high-risk systems must be designed for human oversight (Article 14), deployers must assign oversight to competent people (Article 26), and affected persons can request an explanation of decisions made with certain high-risk systems (Article 86).
Take a credit-scoring model. Under the GDPR, the lender needs a lawful basis, must explain the logic involved and must offer human review if the decision is solely automated. Under the AI Act, creditworthiness assessment is high-risk under Annex III, and the deployer must run a FRIA. Meaningful human oversight serves both laws, but only if the reviewer has real authority and the time to use it.
Transparency
Privacy notices must describe AI-related processing. AI Act Article 50 adds separate duties: tell people they are interacting with a chatbot, disclose emotion recognition and label deepfakes. Workers must be informed before a high-risk system is used in the workplace. One review of your notices, chatbot greetings and labels can satisfy both.
Impact assessments: DPIA and FRIA
The AI Act anticipates the overlap. Article 26(9) tells deployers of high-risk systems to use the provider's instructions for use when carrying out a DPIA. Article 27(4) says that where a DPIA already covers some FRIA obligations, the FRIA complements it. The FRIA is wider: it covers all fundamental rights, such as non-discrimination and access to services, not only privacy. See fundamental rights impact assessment (FRIA) for who must do one and what goes in it. After the Digital Omnibus, the high-risk duties for Annex III systems, including the FRIA, apply from 2 December 2027.
One governance process for both
A combined approach avoids parallel registers, duplicate questionnaires and contradictory answers to staff. A workable model has six steps:
- One inventory. Record each AI use with both sets of attributes: AI Act role and risk tier, plus GDPR role, data categories, lawful basis and retention. Your record of processing activities and your AI register should point at each other.
- One intake gate. New AI tools pass a single review covering prohibited practices, risk tier, Article 50 transparency, DPIA screening and security.
- One combined impact assessment. For high-risk AI using personal data, run the DPIA and FRIA as one document with a shared system description, risk register and mitigations, and separate sign-offs where required.
- One vendor check. Ask AI vendors for data processing terms, sub-processors, data location and model-training use of your data alongside AI Act documentation. Our AI vendor due diligence checklist covers both.
- One training programme. Fold data protection into the AI literacy measures required by Article 4; see the AI literacy requirement.
- Clear ownership. The DPO advises on personal data; an AI governance owner tracks AI Act duties. They should sit in the same review, not in different buildings.
Technical controls help too. Where staff use generative AI with customer or employee data, an EU-hosted gateway that pseudonymises personal data before it reaches the model, blocks secrets and logs each call reduces GDPR exposure and produces an audit trail; this is what Opsio Vault AI is built for. If your gap is on the data protection side, Opsio's GDPR compliance services cover it.
Frequently asked questions
Does the EU AI Act replace the GDPR for AI?
No. Article 2(7) of the AI Act states that it is without prejudice to the GDPR. Whenever an AI system processes personal data, the GDPR applies in full: lawful basis, transparency, data subject rights, security and DPIAs. The AI Act adds requirements on top, depending on the system's risk tier and your role.
Is a DPIA the same as a FRIA?
No, but they overlap. A DPIA under GDPR Article 35 assesses risks to individuals from processing personal data. A FRIA under AI Act Article 27 assesses impacts of a high-risk AI system on all fundamental rights. The AI Act lets the FRIA complement an existing DPIA, so many organisations run them as one combined assessment.
Who enforces the AI Act and the GDPR?
Data protection authorities enforce the GDPR. National market surveillance authorities enforce most of the AI Act, with the AI Office supervising general-purpose AI models. For certain high-risk uses, such as biometrics in law enforcement contexts, data protection authorities also act as market surveillance authorities under Article 74(8), so one regulator may apply both laws.
Can I use special-category data to test my AI for bias?
Possibly. Article 4a of the AI Act, which the Digital Omnibus inserted in place of Article 10(5), provides a legal basis to process special-category data where strictly necessary for detecting and correcting bias, with safeguards such as pseudonymisation, access restrictions and deletion afterwards. You still need to document necessity and meet the remaining GDPR principles.
Which fines are higher, GDPR or AI Act?
The AI Act's top tier is higher: up to €35 million or 7% of worldwide turnover for prohibited practices, against €20 million or 4% under the GDPR. For most other AI Act breaches the cap is €15 million or 3%. Because the laws are separate, one incident can lead to penalties under both.
Get one view of your AI and data risks
Opsio's AI governance and readiness assessment takes about 40 minutes over 14 steps and scores your maturity across ten governance areas. When you submit, it writes four editable Word documents from your answers: an AI governance framework, an AI acceptable use policy, an AI vendor due diligence checklist and an AI risk assessment template. Free, no card, no obligation.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Date-sensitive statements are correct as of October 2026.
Written By
Group COO & CISO
Fredrik is the Group Chief Operating Officer and Chief Information Security Officer at Opsio. He focuses on operational excellence, governance, and information security, working closely with delivery and leadership teams to align technology, risk, and business outcomes in complex IT environments. He leads Opsio's security practice including SOC services, penetration testing, and compliance frameworks.
Editorial standards: This article was written by cloud practitioners and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates on this page show the latest update. Opsio maintains editorial independence.