The AI Act Compared: GDPR, Product Liability, ISO/IEC 42001, NIST AI RMF and US AI Laws

An AI Act comparison sets Regulation (EU) 2024/1689 against the other rules an AI provider or deployer meets: the GDPR, EU product liability law, ISO/IEC 42001, the NIST AI RMF and US AI laws. Each instrument is measured on three points: whether it binds in the EU, how the AI Act positions it, and which dates apply on 24 October 2026. The AI Act itself is a regulation, directly applicable in all Member States.

Regulation (EU) 2024/1689 entered into force on 1 August 2024 and has been amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, since 27 July 2026. The amended text of the EU AI Act sets how the act relates to neighbouring rules, mainly in Article 2 and its recitals. Every status here is dated 24 October 2026.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.

What the Comparison Pages Cover: Five Pages, Six Instruments

Five comparison pages cover six instruments: the GDPR, the Product Liability Directive with the withdrawn AI Liability Directive, ISO/IEC 42001, the NIST AI RMF and US AI laws. Each instrument has one row with its legal nature, status and relation to the AI Act:

Status as of 24 October 2026.

Binding Law or Voluntary Framework: How the Instruments Differ

Two of the instruments bind in the EU next to the AI Act (the GDPR and the Product Liability Directive), one never became law, two are voluntary frameworks and the US laws bind only in their own jurisdictions. The difference decides what follows a breach: a fine, a damages claim, a failed certification audit or nothing under EU law:

Article 99(3) sets EUR 35 million or 7 % as the maximum national penalty rules must provide for prohibited practices, while the GDPR caps fines at EUR 20 million or 4 %, and the guide to EU AI Act penalties sets out AI Act fines next to GDPR fines. Under the Product Liability Directive, non-compliance with mandatory product safety requirements feeds a presumption of defectiveness (Article 10(2)), which in our analysis makes AI Act duties relevant to damages claims.

Where the AI Act Draws the Lines: Articles 2(7), 2(9) and Recital 166

The AI Act states its relation to the other instruments in three places: Article 2(7) for data protection law, Article 2(9) for consumer-protection and product-safety law, and recital 166 for the General Product Safety Regulation. Article 2(7), as amended, makes Union data protection law apply and, without prejudice to Articles 4a and 59, leaves the GDPR, Regulation (EU) 2018/1725 and Directives 2002/58/EC and (EU) 2016/680 unaffected. Before 27 July 2026 it read "without prejudice to Article 10(5) and Article 59"; Regulation (EU) 2026/1744 moved bias-detection processing of special categories of personal data to the new Article 4a.

Article 2(9), unchanged in 2026, keeps Union consumer-protection and product-safety rules unaffected. Recital 166 names Regulation (EU) 2023/988, the General Product Safety Regulation, as the safety net for AI-related products that are not high-risk. Recital 10 adds that the act does not seek to affect existing data protection law.

The AI Act also reaches beyond the Union, where US law meets it. Article 2(1), point (a), covers providers placing AI systems or general-purpose AI models on the Union market wherever they are established, and point (c) covers third-country providers and deployers whose output is used in the Union, so Article 2 sets who the EU AI Act applies to in every comparison. No US statute or NIST framework alters that reach.

Which Instruments Can Show Conformity with the AI Act?

Only a harmonised standard whose reference is published in the Official Journal gives a presumption of conformity with the AI Act (Article 40(1)), and on 24 October 2026 the only such standard is EN 18286:2026. Implementing Decision (EU) 2026/2274 (OJ L, 2026/2274, 14.10.2026) cites it with effect from publication on 14 October 2026, and the Commission states that EN 18286:2026 gives a presumption of conformity with the Article 17 quality management system requirements it covers. No common specifications adopted under Article 41 appear in the Publications Office (Cellar) record as of 23 October 2026.

ISO/IEC 42001:2023, the AI management-system standard of ISO/IEC JTC 1/SC 42, gives no presumption, because neither it nor EN ISO/IEC 42001:2026 is cited in the Official Journal. The Commission's standardisation Q&A (updated 10 March 2026) states that "although ISO/IEC 42001:2023 helps to set up an AI management system, its goals and definitions are not aligned with the quality management system that is required under the AI Act". Annex C of EN 18286:2026 sets out its correspondence with EN ISO/IEC 42001:2026.

The NIST AI RMF 1.0 (NIST AI 100-1), released on 26 January 2023 and described by NIST as "intended for voluntary use", gives no presumption either. Besides standards and common specifications, providers of general-purpose AI models can rely on codes of practice to demonstrate compliance (Articles 53(4) and 55(2)), and the guide to AI Act conformity assessment explains how conformity is shown for high-risk AI systems. The NIST framework page states that "The AI RMF 1.0 is being revised as part of the White House AI Action Plan"; no revised version is published as of 24 October 2026.

Key Dates Side by Side across the Six Instruments

On 24 October 2026 the GDPR and most of the AI Act already apply, while the application of the Product Liability Directive and of the AI Act high-risk rules in Chapter III Sections 1 to 3 is still ahead. The voluntary frameworks carry no application date. The EU AI Act timeline dates every stage of the act; the six instruments run in this sequence:

Status on 24 October 2026.

Which Comparison Fits Your AI System?

The comparison that fits depends on what the AI system does and where it is used: personal data, damage claims, a management system, a risk framework or US operations. Providers outside the Union meet the act through its territorial scope, which the guide to the EU AI Act for non-EU companies explains for US, UK and other providers. Each starting point leads to one comparison:

• Personal data: AI Act vs GDPR.
• Damage claims: AI liability in the EU.
• A management system: ISO/IEC 42001 and the EU AI Act, for certified organisations.
• A risk framework: NIST AI RMF vs EU AI Act, for organisations applying its GOVERN, MAP, MEASURE and MANAGE functions.
• US operations: EU AI Act vs US AI laws.

The starting points give an orientation, not a legal assessment. One AI system can meet several instruments at once, and AI Act duties turn on the operator role and risk class.

Where several instruments apply, one programme can trace each duty to its article and date. The guide to EU AI Act compliance builds that step-by-step programme for providers and deployers.

The AI Act Compared: Related Questions

The related questions turn on Article 2(7), Directive (EU) 2024/2853, US statutes, Regulation (EU) 2026/1744 and sibling EU regulations.

Does the AI Act Replace the GDPR?

No: the GDPR keeps applying to personal data processed with AI systems, since Article 2(7) leaves it unaffected. Under Article 27(4), as amended, the deployer may include cross-references to the data protection impact assessment in the fundamental rights impact assessment, a point the AI Act vs GDPR comparison develops. Where personal data are processed, the EU declaration of conformity states compliance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680 (Annex V, point 5).

Who Pays When an AI System Causes Damage?

The AI Act contains no liability rule; compensation for damage caused by defective products, software included, follows Directive (EU) 2024/2853 for products placed on the market after 9 December 2026 and Directive 85/374/EEC for earlier ones. The AI liability in the EU comparison covers both directives and the withdrawn 2022 AI Liability Directive proposal.

Does the United States Have an AI Act?

The US laws compared with the AI Act on this site are state statutes (Colorado SB26-189, Texas HB 149, the New York RAISE Act, California SB 53) and federal executive orders such as Executive Order 14365 of 11 December 2025. The EU AI Act vs US AI laws comparison sets them against AI Act thresholds and penalties.

Which AI Act Dates Changed in 2026?

Regulation (EU) 2026/1744 moved the start of Chapter III Sections 1 to 3, the high-risk rules, to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems; before 27 July 2026 the dates were 2 August 2026 and 2 August 2027. The Digital Omnibus on AI sets out what Regulation (EU) 2026/1744 changed. The data and cyber Digital Omnibus, COM(2025) 837, is a different, pending proposal ("Awaiting committee decision", OEIL, 24 October 2026) that does not amend the AI Act.

Frequently Asked Questions about the AI Act Compared

Is ISO/IEC 42001 certification enough to comply with the AI Act?

No. ISO/IEC 42001 certification gives no presumption of conformity with the AI Act, because only harmonised standards whose references are published in the Official Journal give one (Article 40(1)). Certification remains a voluntary management-system audit.

Is the NIST AI RMF binding in the EU?

No. NIST describes AI RMF 1.0 as "intended for voluntary use", and it has no legal effect in the EU. Applying its four functions does not create a presumption of conformity with the AI Act.

Does the GDPR still apply to AI systems?

Yes. Article 2(7), as amended in 2026, keeps Union data protection law applicable, and recital 10 confirms that data subjects keep their rights, including those on solely automated decision-making.

Is the 2022 AI liability proposal still pending?

No. The Commission withdrew the AI Liability Directive proposal, COM(2022) 496, and the withdrawal was published in OJ C/2025/5423 of 6 October 2025. Compensation for defective products follows the product liability directives instead.