AI Act Meets GDPR: Where the Two Frameworks Overlap

The legal framework

The AI Act (Regulation (EU) 2024/1689) and the GDPR (Regulation (EU) 2016/679) apply at the same time. The AI Act says so itself: it is without prejudice to Union data protection law (Article 2(7)). The GDPR is triggered by the processing of personal data. The AI Act is triggered by the placing on the market or use of an AI system, whether or not personal data are involved. Most business AI systems fall under both.

Roles do not line up

The AI Act speaks of providers and deployers. The GDPR speaks of controllers and processors. A deployer is usually the controller of the personal data it feeds into a system. A provider may be a processor, a joint controller, or an independent controller, for example when it uses customer data to improve its model. The roles must be determined separately under each regime and written into the contract.

Impact assessments

• A DPIA (GDPR Article 35) is required where processing is likely to result in a high risk to individuals, including systematic evaluation with significant effects, large-scale special category data and systematic monitoring.
• A fundamental rights impact assessment (AI Act Article 27) is required before first use of a high-risk system by public bodies, private entities providing public services, and deployers of certain credit-scoring and insurance systems. It covers all fundamental rights, not just privacy.
• Where both apply, the FRIA may complement the DPIA (Article 27(4)). The assessments overlap but neither replaces the other. Deployers of high-risk systems use the provider's information to carry out their DPIA (Article 26(9)).

Automated decisions and transparency

GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, with exceptions that require safeguards such as human intervention. In SCHUFA (C-634/21), the Court of Justice held that a probability score can itself be such a decision where a third party draws strongly on it. The AI Act adds a right to an explanation of the role of a high-risk system in a decision (Article 86), human oversight (Article 14), and the information duties of Articles 13 and 26. GDPR Articles 13 to 15 require meaningful information about the logic involved.

Data quality, bias and special categories

Providers of high-risk systems must use training, validation and testing data that is relevant, representative and as free of errors as possible (Article 10). To detect and correct bias, Article 10(5) lets providers process special category data under strict conditions, such as necessity, technical safeguards and deletion after use. This is an AI Act basis for the purpose; the GDPR's general principles, including data minimisation and purpose limitation, still apply. The European Data Protection Board addressed the use of personal data in AI models in its Opinion 28/2024.

Other points of contact

• Records and accountability. GDPR Article 30 records and AI Act technical documentation should be maintained together to avoid contradictions.
• Breach and incident reporting. A personal data breach goes to the data protection authority within 72 hours (Article 33). Serious incidents with high-risk systems are reported under Article 73 AI Act. One event can trigger both.
• Supervision. The data protection authority supervises the GDPR. The AI Act uses market surveillance authorities designated by each Member State. Check who is competent in your sector.

In practice

A Hasselt insurance broker uses an AI tool to triage claims and flag suspected fraud. The broker as controller needs a lawful basis, privacy notices that mention the profiling, and a DPIA. Because a flag can lead to a refused claim, Article 22 requires a claims handler to make the real decision, with the ability to depart from the tool's recommendation. It documents oversight under the AI Act and uses one assessment file for both frameworks, with separate sections where the legal tests differ.

Frequently asked questions

If we comply with the GDPR, are we compliant with the AI Act?

No. The AI Act has requirements, such as risk management, documentation and conformity assessment, that the GDPR does not contain.

Does a DPIA satisfy the fundamental rights impact assessment?

Not by itself. It can serve as a basis, but the FRIA must cover wider rights and the AI Act's content requirements.

Can we use special category data to test for bias?

Under Article 10(5) of the AI Act, if the conditions are met and no other data would do. Document the necessity and safeguards.

Who answers a data subject's request about an AI decision?

The controller. The provider should support the controller through contract.

How this connects

In AI Act compliance we treat both frameworks together. Our compliance registers keep the GDPR records of processing next to the AI Act records, and our DPIA tool lets you and your attorney complete assessments as one working record. See also building an AI governance framework.