--- title: "AI Act Meets GDPR: Where the Two Frameworks Overlap | Pitch" description: "How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special…" url: https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://www.pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # AI Act Meets GDPR: Where the Two Frameworks Overlap How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework The AI Act (Regulation (EU) 2024/1689) and the GDPR (Regulation (EU) 2016/679) apply at the same time. The AI Act says so itself: it is without prejudice to Union data protection law (Article 2(7)). The GDPR is triggered by the processing of personal data. The AI Act is triggered by the placing on the market or use of an AI system, whether or not personal data are involved. Most business AI systems fall under both. ### Roles do not line up The AI Act speaks of providers and deployers. The GDPR speaks of controllers and processors. A [deployer](https://www.pitch.law/academy/provider-vs-deployer-ai-act) is usually the controller of the personal data it feeds into a system. A provider may be a processor, a joint controller, or an independent controller, for example when it uses customer data to improve its model. The roles must be determined separately under each regime and written into the contract. ### Impact assessments - A **DPIA** (GDPR Article 35) is required where processing is likely to result in a high risk to individuals, including systematic evaluation with significant effects, large-scale special category data and systematic monitoring. - A **fundamental rights impact assessment** (AI Act Article 27) is required before first use of a high-risk system by public bodies, private entities providing public services, and deployers of certain credit-scoring and insurance systems. It covers all fundamental rights, not just privacy. - Where both apply, the FRIA may complement the DPIA (Article 27(4)). The assessments overlap but neither replaces the other. Deployers of high-risk systems use the provider's information to carry out their DPIA (Article 26(9)). ### Automated decisions and transparency GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, with exceptions that require safeguards such as human intervention. In _SCHUFA_ (C-634/21), the Court of Justice held that a probability score can itself be such a decision where a third party draws strongly on it. The AI Act adds a right to an explanation of the role of a high-risk system in a decision (Article 86), human oversight (Article 14), and the information duties of Articles 13 and 26. GDPR Articles 13 to 15 require meaningful information about the logic involved. ### Data quality, bias and special categories Providers of high-risk systems must use training, validation and testing data that is relevant, representative and as free of errors as possible (Article 10). To detect and correct bias, Article 10(5) lets providers process special category data under strict conditions, such as necessity, technical safeguards and deletion after use. This is an AI Act basis for the purpose; the GDPR's general principles, including data minimisation and purpose limitation, still apply. The European Data Protection Board addressed the use of personal data in AI models in its Opinion 28/2024. ### Other points of contact - **Records and accountability.** GDPR Article 30 records and AI Act technical documentation should be maintained together to avoid contradictions. - **Breach and incident reporting.** A personal data breach goes to the data protection authority within 72 hours (Article 33). Serious incidents with high-risk systems are reported under Article 73 AI Act. One event can trigger both. - **Supervision.** The data protection authority supervises the GDPR. The AI Act uses market surveillance authorities designated by each Member State. Check who is competent in your sector. ## In practice A Hasselt insurance broker uses an AI tool to triage claims and flag suspected fraud. The broker as controller needs a lawful basis, privacy notices that mention the profiling, and a DPIA. Because a flag can lead to a refused claim, Article 22 requires a claims handler to make the real decision, with the ability to depart from the tool's recommendation. It documents oversight under the AI Act and uses one assessment file for both frameworks, with separate sections where the legal tests differ. ## Frequently asked questions ### If we comply with the GDPR, are we compliant with the AI Act? No. The AI Act has requirements, such as risk management, documentation and conformity assessment, that the GDPR does not contain. ### Does a DPIA satisfy the fundamental rights impact assessment? Not by itself. It can serve as a basis, but the FRIA must cover wider rights and the AI Act's content requirements. ### Can we use special category data to test for bias? Under Article 10(5) of the AI Act, if the conditions are met and no other data would do. Document the necessity and safeguards. ### Who answers a data subject's request about an AI decision? The controller. The provider should support the controller through contract. ## How this connects In [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) we treat both frameworks together. [Our compliance registers](https://www.pitch.law/technologies/privacy-register) keep the GDPR records of processing next to the AI Act records, and [our DPIA tool](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) lets you and your attorney complete assessments as one working record. See also [building an AI governance framework](https://www.pitch.law/academy/building-an-ai-governance-framework). ## In short - Why compliance with one framework does not replace the other - DPIA and fundamental rights impact assessment compared - Automated decisions and transparency - Bias testing and special category data ## Related solutions - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) ## Technology we use - [Technology](https://www.pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ## More in Legal Aspects of Artificial Intelligence - ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - ### [AI Clauses in Vendor Contracts](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) [Which clauses to expect and negotiate when you buy or supply AI: AI Act allocation, data use, output ownership, IP indemnity, liability and change control.](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) - ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data, Copyright and Disclosure](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) - ### [The AI Literacy Obligation](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)