EU AI Act (Regulation 2024/1689) vs GDPR (Regulation 2016/679)

Why this comparison matters

The EU AI Act and GDPR are the two most consequential EU regulations for any organisation that processes data using algorithmic or machine learning systems. They are often discussed as alternatives or successors to each other — they are neither. They are concurrent, overlapping frameworks, each enforced by different authorities, each with its own documentation architecture, and each capable of issuing independent fines for the same underlying system. GDPR governs what happens to personal data: why it is collected (lawful basis under Article 6), how long it is kept, how it is secured, how data subject rights are managed, and whether automated decisions affecting individuals are subject to meaningful human oversight (Article 22). GDPR is technology-neutral — it applies the same whether your organisation uses spreadsheets or neural networks. What matters is that personal data is involved. The AI Act is technology-specific and risk-based. It does not care whether personal data is involved; it cares whether the AI system carries risk to fundamental rights, health, safety, or critical infrastructure. A high-risk AI system that processes no personal data at all (e.g. an AI system controlling industrial safety equipment) is still fully subject to the AI Act. Conversely, a traditional database query that processes personal data is entirely outside the AI Act's scope. The overlap zone is the most operationally demanding: AI systems that both qualify as high-risk under the AI Act and process personal data. An example is an AI hiring tool — it is likely high-risk under Annex III point 4 (employment, workers management) and it processes personal data (CVs, application data) triggering GDPR Article 35 DPIA obligations. For this system, the compliance team must maintain a ROPA entry (GDPR Article 30), complete a DPIA (GDPR Article 35), produce an Annex IV technical documentation file (AI Act), register in the EU AI database (AI Act Article 60), and set up human oversight procedures (AI Act Article 26 + GDPR Article 22). These are parallel, non-substitutable obligations. The practical consequence for compliance teams: a GDPR audit alone is not AI Act compliance. An AI Act conformity assessment alone is not GDPR compliance. GDPR's data-by-design principle (Article 25) and the AI Act's accuracy, robustness, and data governance requirements (Article 10) overlap significantly in their technical controls but diverge enough in documentation format and supervisory audience that managing them separately generates duplication and gaps. The cleanest approach is to build a single AI system inventory that feeds both the ROPA and the Annex IV technical file, with the DPIA and the AI Act conformity assessment cross-referenced from a shared risk record.

Verdict by use case

Migration considerations

Organisations typically approach GDPR and AI Act compliance sequentially — GDPR first (in force since 2018), AI Act second (high-risk system obligations from August 2026). This is understandable chronologically but creates a rework problem: GDPR records were built without the AI Act's documentation requirements in mind, and AI Act implementation projects often start from scratch rather than extending the GDPR record. The more efficient path is convergence: treat each AI system that processes personal data as a shared object in a single compliance record. Start from the ROPA entry (GDPR Art. 30), then extend it with the AI Act Annex IV fields — intended purpose, risk classification, data governance measures, accuracy metrics, human oversight arrangements, and technical documentation version. This way, a DPA audit request (GDPR) and a market surveillance authority inspection (AI Act) can be answered from the same source file. Where a DPIA is required under GDPR Article 35, structure it to double as the AI Act's fundamental rights impact assessment — the substantive questions overlap considerably. The key discipline: maintain one AI inventory with separate compliance layers, rather than two siloed record sets that reference each other imprecisely.