AI Act Guide
  1. Home
  2. AI Act and other laws
  3. AI Act vs GDPR

AI Act and other laws

AI Act vs GDPR: Where the Two Regulations Overlap and Differ

How the EU AI Act and the GDPR overlap and differ: scope, DPIA, Article 4a bias data, supervisors, fines of 7 % vs 4 % and the 2026 changes.

Last updated 24 October 2026 · By the AIActGuide.net Editorial Team · How we fact-check · Print this page

The EU AI Act and the GDPR apply side by side: Article 2(7) of Regulation (EU) 2024/1689 leaves Regulation (EU) 2016/679 unaffected, so an AI system that processes personal data must meet both. Eleven interface provisions of the AI Act tie the two together.

The GDPR (OJ L 119, 4.5.2016, p. 1) applies since 25 May 2018 (Article 99(2) GDPR). The EU AI Act, in force since 1 August 2024 and amended by Regulation (EU) 2026/1744 (in force since 27 July 2026), regulates AI systems next to the GDPR it leaves unaffected.

This page compares the two regulations point by point, including the GDPR changes proposed in 2025.

AI Act vs GDPR Side by Side: Scope, Addressees, Assessments, Supervisors, Fines and Dates

The AI Act regulates AI systems and general-purpose AI models placed on the Union market or whose output is used in the Union, while the GDPR governs the processing of personal data. The two regulations differ on ten points:

Point EU AI Act GDPR
Instrument Regulation (EU) 2024/1689, OJ L, 2024/1689, 12.7.2024, as amended by Regulation (EU) 2026/1744 (OJ L, 2026/1744, 24.7.2026) Regulation (EU) 2016/679, OJ L 119, 4.5.2016, p. 1
Dates In force 1 August 2024; applies in stages from 2 February 2025 to 2 August 2028 Applies since 25 May 2018 (Art. 99(2) GDPR)
Trigger An AI system or model on the Union market or with output used in the Union (Art. 2(1)) Processing of personal data; the AI Act leaves it unaffected (Art. 2(7) AI Act)
Territorial reach Market access (Art. 2(1)(a)) and output used in the Union (Art. 2(1)(c)) Establishment (Art. 3(1)) and targeting or monitoring of data subjects in the Union (Art. 3(2))
Addressees Six operator roles (Art. 3(8)); affected persons located in the Union (Art. 2(1)(g)) Data subjects hold the rights, such as the Art. 22 right on automated decisions
Approach Risk classes: prohibited practices (Art. 5), high-risk systems (Annex III: 8 areas, 25 use cases), transparency (Art. 50) Duties per processing operation, such as the DPIA for processing likely to result in a high risk (Art. 35)
Assessments Conformity assessment by the provider (Art. 43); fundamental rights impact assessment by certain deployers (Art. 27) Data protection impact assessment (Art. 35)
Supervisors Notifying and market surveillance authorities designated by each Member State (Art. 70); AI Office, a Commission function (Art. 3(47)) Data protection supervisory authorities, whose powers the AI Act leaves unaffected (recital 10 AI Act)
Maximum fine Tiered; highest tier for prohibited practices (Art. 99(3)) Tiered; highest tier under Art. 83(5) GDPR
Pending changes None in COM(2025) 837, which does not amend the AI Act Five AI-relevant changes proposed in COM(2025) 837

The GDPR has applied in full since 2018, while the AI Act applies in stages from 2 February 2025 to 2 August 2028. The AI Act compared with other frameworks uses the same points for liability, standards and non-EU law.

Article 113 AI Act sets those application dates, as the AI Act timeline records.

Which Regulation Applies: Personal Data versus AI Systems on the Union Market

Both regulations apply whenever an AI system covered by Article 2(1) of the AI Act processes personal data, because the AI Act attaches to the system and the GDPR to the processing.

Article 2(1) names seven addressee groups, points (a) to (g), applying since 2 February 2025. The test of who the EU AI Act applies to under Article 2 also covers exclusions, such as military uses.

The Without-Prejudice Clause and Recital 10

Article 2(7) states that Union data protection law applies to personal data processed in connection with the AI Act and that the act does not affect the GDPR, Regulation (EU) 2018/1725 or Directives 2002/58/EC and (EU) 2016/680, without prejudice to Articles 4a and 59.

Before 27 July 2026, the opening sentence on Union data protection law was the same, and the second sentence ended with "without prejudice to Article 10(5) and Article 59 of this Regulation".

Recital 10 explains the clause: the act does not affect existing data protection law, including the powers of the supervisory authorities, and data subjects keep their rights, including on solely automated decision-making.

Territorial Reach: Establishment and Targeting versus Market Access and Output

The GDPR reaches organisations through establishment in the Union and through offering goods or services to, or monitoring, data subjects in the Union (Article 3(1) and (2) GDPR); the AI Act reaches providers through the Union market (Article 2(1)(a)) and third-country providers and deployers through output used in the Union (Article 2(1)(c)).

Point (a) applies irrespective of establishment. In our reading, point (c) has no counterpart in Article 3 GDPR, so one company can meet one test and not the other. The EU AI Act for non-EU companies applies these market and output tests to third-country providers.

Shared Definitions: Personal Data, Special Categories and Profiling

The AI Act borrows its data protection terms from the GDPR instead of defining them anew. Four Article 3 definitions point to Union data protection law:

  • Personal data (Article 3(50)): as defined in Article 4, point (1), GDPR.
  • Non-personal data (Article 3(51)): data other than personal data as defined in Article 4, point (1), GDPR.
  • Special categories of personal data (Article 3(37)): Article 9(1) GDPR and the matching provisions of Directive (EU) 2016/680 and Regulation (EU) 2018/1725.
  • Profiling (Article 3(52)): as defined in Article 4, point (4), GDPR.

Biometric data has its own AI Act definition: personal data resulting from specific technical processing of a natural person's physical, physiological or behavioural characteristics, such as facial images (Article 3(34)).

Who Is Addressed: Operators, Data Subjects and Affected Persons

The AI Act addresses six operator roles, mainly providers and deployers, and gives affected persons in the Union their own rights, while the GDPR protects data subjects whatever the AI Act role of the organisation processing their data. Each role meets personal data through different provisions:

Role Definition in short Provisions touching personal data
Provider (Art. 3(3)) Develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name or trademark Art. 4a(1) bias-detection processing; Annex V, point 5 GDPR statement
Deployer (Art. 3(4)) Uses an AI system under its authority, except in a personal non-professional activity Arts 4a(2), 26(9), 26(11), 27(4), 50(3)
Importer, distributor, authorised representative, product manufacturer Supply-chain roles of Art. 3(5) to (7) and Art. 2(1)(e) No provision specific to personal data
Affected person (Art. 2(1)(g)) Person located in the Union Art. 86 explanation of deployer decisions
Commission Controller of the EU database (Art. 71(6)) Art. 71(5): only names and contact details of the persons registering

One organisation can be provider of one system and deployer of another. The AI Act roles decide how duties split for each system.

In our reading, the AI Act role does not settle the GDPR role of an organisation; each regulation applies its own definitions.

Where the Duties Overlap: The Interface Provisions

The AI Act ties personal data and data protection law into its own duties through eleven interface provisions, each with its own application date between 2 February 2025 and 2 August 2028. They sit in six chapters and Annex V:

Provision Subject Applies since or from
Art. 2(7) Union data protection law applies; the GDPR is unaffected, without prejudice to Arts 4a and 59 Since 2 February 2025; current wording since 27 July 2026
Art. 5(1)(g) and Art. 5(1), second subparagraph Ban on biometric categorisation by sensitive attributes; point (h) without prejudice to Art. 9 GDPR Since 2 February 2025
Art. 4a Special categories of personal data for bias detection and correction Since 27 July 2026
Art. 50(3) Information to persons exposed to emotion recognition or biometric categorisation Since 2 August 2026
Art. 59 Further processing of personal data in the AI regulatory sandbox Since 2 August 2026
Art. 74(8) Data protection authorities as market surveillance authorities Since 2 August 2026
Art. 86 Explanation of deployer decisions, subsidiary to other Union law Chapter IX, applicable since 2 August 2026
Art. 26(9) Provider information used for the DPIA From 2 December 2027 (Annex III); 2 August 2028 (Annex I)
Art. 26(11) Information to persons subject to Annex III systems From 2 December 2027
Art. 27(4) Fundamental rights impact assessment may cross-reference the DPIA From 2 December 2027 (Annex III only)
Annex V, point 5 (Art. 47) GDPR statement in the EU declaration of conformity Part of the Article 47 declaration drawn up for each high-risk system

Sensitive Data for Bias Detection and Correction: What Replaced Article 10(5)

Since 27 July 2026, Article 4a(1) allows providers of high-risk AI systems to process special categories of personal data exceptionally, to the extent strictly necessary for bias detection and correction, in addition to the conditions of the GDPR. It serves Article 10(2), points (f) and (g), under six conditions:

  • (a) No effective alternative, including synthetic or anonymised data.
  • (b) Re-use limits, state-of-the-art security and pseudonymisation.
  • (c) Access controls and documentation.
  • (d) No transmission to or access by other parties.
  • (e) Deletion once the bias is corrected or the retention period ends.
  • (f) Records of processing state why it was strictly necessary.

Article 4a(2) extends the permission, under the same conditions, to providers and deployers of other AI systems and models and to deployers of high-risk systems, without creating any obligation to conduct bias detection.

Article 10(5) was deleted by Article 1(9)(b) of Regulation (EU) 2026/1744, and its substance moved to Article 4a(1). Recital 9 of that regulation refers to Article 9(2)(g) GDPR, Article 10(2)(g) of Regulation (EU) 2018/1725 and Article 10, point (a), of Directive (EU) 2016/680. The Article 10 practices for training data belong to data governance.

DPIA and the AI Act: Article 26(9) Inputs and the Cross-Reference Option

Deployers of high-risk AI systems use the provider's Article 13 information to carry out their data protection impact assessment under Article 35 GDPR (Article 26(9) AI Act), from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Law-enforcement deployers use it under Article 27 of Directive (EU) 2016/680.

Since 27 July 2026, where a fundamental rights impact assessment obligation is already met through the DPIA, Article 27(4) lets the deployer include cross-references to, or relevant parts of, that DPIA; before, the assessment "shall complement that DPIA". Article 27(1) requires that assessment from bodies governed by public law, private entities providing public services and deployers of Annex III, points 5(b) and 5(c), systems, for Annex III systems except point 2.

Article 35(1) GDPR requires a DPIA where processing, in particular with new technologies, is likely to result in a high risk; Article 35(3) adds three mandatory cases, among them systematic automated evaluation including profiling. Article 27(5) AI Act provides for an AI Office template questionnaire that allows DPIA cross-references.

Automated Decision-Making, Profiling and High-Risk Classification

The GDPR gives data subjects the right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects (Article 22(1) GDPR), subject to three exceptions and minimum safeguards (Article 22(2) and (3)).

The AI Act uses the GDPR's profiling definition in Article 6(3). That provision sets four alternative conditions under which an Annex III system is not high-risk, but an Annex III system that performs profiling of natural persons always stays among the high-risk AI systems.

Article 86(1) gives affected persons the right to clear and meaningful explanations of the role of the AI system and the main elements of a deployer decision based on the output of an Annex III high-risk system, except point 2, where the decision has legal or similarly significant effects that they consider adverse to their health, safety or fundamental rights. Article 86(3) limits the right to the extent it is not otherwise provided for under Union law, such as the GDPR.

Biometric Data and the Prohibited Practices

Since 2 February 2025, Article 5(1)(g) bans biometric categorisation that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation, and categorisation by other Article 9(1) GDPR categories falls under Annex III point 1(b). The ban does not cover labelling or filtering of lawfully acquired biometric datasets, including in law enforcement.

Under the second subparagraph of Article 5(1), point (h) is without prejudice to Article 9 GDPR for biometric processing other than for law enforcement. The current Article 5(1) holds ten lettered points of prohibited AI practices: points (a), (b) and (c) to (h) apply since 2 February 2025, points (ba) and (bb) from 2 December 2026.

Article 5(4) requires every use of real-time remote biometric identification for law enforcement to be notified to the relevant market surveillance authority and to the national data protection authority.

Information to Individuals: Article 50(3) and Deployer Notices

Since 2 August 2026, deployers of emotion recognition and biometric categorisation systems must inform the people exposed to them (Article 50(3)).

From 2 December 2027, deployers of Annex III high-risk systems that make or assist decisions about natural persons inform those persons that they are subject to the system (Article 26(11)).

In our reading, both notices add to the GDPR's information duties. The transparency obligations under Article 50 also cover chatbots and deep fakes, with breaches in the Article 99(4) fine tier.

The GDPR Statement in the EU Declaration of Conformity

Where an AI system processes personal data, the provider's EU declaration of conformity states that it complies with the GDPR, Regulation (EU) 2018/1725 and Directive (EU) 2016/680 (Annex V, point 5). The statement is one of eight items of Annex V, and the EU declaration of conformity under Article 47 is drawn up for high-risk systems.

Personal Data in the Regulatory Sandbox

Article 59 lets personal data lawfully collected for other purposes be processed in an AI regulatory sandbox solely to develop, train and test certain public-interest AI systems. Ten cumulative conditions, points (a) to (j), apply since 2 August 2026.

Five public-interest areas qualify, such as public health and public services. National AI regulatory sandboxes must be operational by 2 August 2027 (Article 57(1)).

Supervisors and Fines under the Two Regulations

Data protection authorities supervise the GDPR, and for some high-risk AI systems the AI Act requires Member States to designate them, or another authority meeting the same conditions, as market surveillance authorities.

Data Protection Authorities with an AI Act Supervisory Role

For Annex III, point 1, systems used for law enforcement, border management, justice and democracy, and for Annex III, points 6, 7 and 8, Member States shall designate as market surveillance authorities either the data protection supervisory authorities under the GDPR or Directive (EU) 2016/680, or another authority designated under the conditions of Articles 41 to 44 of that directive (Article 74(8)).

Article 70 obliged each Member State to designate a notifying authority, a market surveillance authority and a single point of contact by 2 August 2025. The national competent authorities of the 27 Member States include these designations.

For Union institutions, bodies, offices and agencies, the European Data Protection Supervisor is the market surveillance authority, except for the Court of Justice acting in its judicial capacity (Article 74(9)), and it fines them under Article 100.

Maximum Fines Compared

The AI Act's highest fine, EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher (Article 99(3)), exceeds the GDPR's highest, EUR 20 000 000 or 4 %, whichever is higher (Article 83(5) GDPR). Article 99 sets the maximum fines that national penalty rules must provide for (Article 99(1)):

Instrument Infringement Maximum Provision
AI Act Prohibited practices (Art. 5) EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher Art. 99(3)
AI Act Operator duties, including deployers (Art. 26) and transparency (Art. 50) EUR 15 000 000 or 3 % of total worldwide annual turnover, whichever is higher Art. 99(4)
AI Act Incorrect, incomplete or misleading information EUR 7 500 000 or 1 % of total worldwide annual turnover, whichever is higher Art. 99(5)
AI Act General-purpose AI model providers (imposed by the Commission) 3 % of annual total worldwide turnover or EUR 15 000 000, whichever is higher Art. 101(1)
AI Act Union institutions (imposed by the EDPS) EUR 1 500 000 (Art. 5); EUR 750 000 (other breaches) Art. 100
GDPR Higher tier EUR 20 000 000 or 4 % of total worldwide annual turnover, whichever is higher Art. 83(5) GDPR
GDPR Lower tier EUR 10 000 000 or 2 %, whichever is higher Art. 83(4) GDPR

The Article 99 tiers apply since 2 August 2025. Within these caps, AI Act fines follow national rules; Article 101 fines are the only ones the Commission imposes directly.

Fines on SMEs are capped at the lower of the two amounts in every Article 99 tier (Article 99(6)), fines on small mid-caps only in the Article 99(4) and (5) tiers (Article 99(6a)). Article 27 and Article 4 carry no EU fine amount.

What Regulation (EU) 2026/1744 Changed at the GDPR Interface

Regulation (EU) 2026/1744, in force since 27 July 2026, changed three interface points: it amended Article 2(7), moved bias-detection processing from Article 10(5) into the new Article 4a, and replaced the "shall complement" rule of Article 27(4) with a cross-reference option. It did not amend the GDPR:

Provision Before 27 July 2026 Since 27 July 2026
Art. 2(7) Union data protection law applies; GDPR unaffected, "without prejudice to Article 10(5) and Article 59" Union data protection law applies; GDPR unaffected, without prejudice to Articles 4a and 59
Art. 10(5) and Art. 4a Art. 10(5) allowed providers of high-risk systems to process special categories for bias detection Art. 10(5) deleted; Art. 4a(1) for high-risk providers, Art. 4a(2) for other providers and deployers
Art. 27(4) Fundamental rights impact assessment "shall complement that DPIA" Deployer may include cross-references to or relevant parts of the DPIA

These three rows are the GDPR-facing part of the Digital Omnibus on AI. The other changes made by Regulation (EU) 2026/1744 concern dates, SMC relief and AI Office competence.

The EDPB and EDPS commented on the proposal for that regulation, COM(2025) 836, in Joint Opinion 1/2026; the EDPB press release on that opinion states: "Administrative simplification must not, however, lower the protection of fundamental rights."

Pending GDPR Amendments Proposed in COM(2025) 837

The Commission's general Digital Omnibus proposal COM(2025) 837 of 19 November 2025 proposes five GDPR changes that matter for AI, and none is law: procedure 2025/0360(COD) was "Awaiting committee decision" in the European Parliament on 24 October 2026 (OEIL). Each change is proposed, not adopted:

  • Article 4(1) (proposed): information is not personal for an entity that cannot identify the person by means reasonably likely to be used.
  • Article 9(2)(k) (proposed): processing for developing and operating an AI system or model, subject to Article 9(5).
  • Article 22 recast (proposed): solely automated decisions only where necessary for a contract, authorised by law or based on explicit consent.
  • Article 33(1) (proposed): breach notification where a high risk is likely, within 96 hours, via the NIS2 single-entry point.
  • Article 88c (proposed): legitimate interests (Article 6(1)(f)) for AI development and operation, with safeguards including an unconditional right to object.

The single-entry point belongs to NIS2.

COM(2025) 837 does not amend the AI Act: Regulation (EU) 2024/1689 is not among the acts it amends.

Data Protection Guidance on AI: EDPB Opinions and Guidelines

The European Data Protection Board has issued one opinion on AI models, two joint opinions with the EDPS on the omnibus proposals and two draft guidelines open for consultation until 30 October 2026, while joint Commission-EDPB guidelines are listed as planned. None of them is AI Act law:

Document Body Date and status Subject
Opinion 28/2024 EDPB Adopted 18 December 2024 (Art. 64(2) GDPR opinion) Data protection aspects of processing personal data in the context of AI models
Joint Opinion 1/2026 EDPB and EDPS Adopted (legislative opinion) Proposal COM(2025) 836, the Digital Omnibus on AI
Joint Opinion 2/2026 EDPB and EDPS Adopted 11 February 2026 Proposal COM(2025) 837
Guidelines 02/2026 EDPB Draft of 8 July 2026; consultation to 30 October 2026, 23:59 CET Anonymisation
Guidelines 03/2026 EDPB Draft of 8 July 2026; consultation to 30 October 2026, 23:59 CET Web scraping in the context of generative AI
Joint Commission-EDPB guidelines Commission and EDPB Listed as planned (Commission guidelines overview, updated 31 July 2026) Interplay between the GDPR and the AI Act

Commission guidance under the AI Act runs separately: the register of AI Act guidelines tracks each document with its date and status. Opinion 28/2024 concerns AI models; the AI Act regulates general-purpose AI models in Chapter V.

One Compliance Programme for Both Regulations

In our reading, one programme can serve both regulations when it records, per AI system, the AI Act role and risk class next to the personal data processed and the DPIA. Seven steps connect them:

  1. List each AI system with its AI Act role and the personal data it processes, in one AI inventory.
  2. Screen each system against Article 5 (points (a), (b) and (c) to (h) since 2 February 2025; (ba) and (bb) from 2 December 2026), Annex III with Article 6(3) and Article 50, for example with the EU AI Act Compliance Checker.
  3. Document bias-detection processing against Article 4a(1), points (a) to (f).
  4. Build the DPIA on the provider's Article 13 information (Article 26(9)).
  5. Cross-reference the DPIA where Article 27(1) applies (Article 27(4)).
  6. Include the Annex V, point 5, statement in each EU declaration of conformity where personal data are processed.
  7. Identify the market surveillance authority, including under Article 74(8).

In our reading, three things stay separate: the Article 43 conformity assessment, the GDPR legal basis for processing and the fines.

Further AI Act duties, such as AI literacy, have no GDPR counterpart. An EU AI Act compliance programme adds them step by step.

The steps give an orientation on what the two regulations require; they do not decide whether a specific system is high-risk or a processing operation lawful.

Beyond the GDPR: How the AI Act Compares with Other Frameworks

The GDPR is one of five frameworks compared with the AI Act here, and the only binding Union law on personal data that applies alongside it to the same AI system.

The Product Liability Directive binds, while ISO/IEC 42001 and the NIST AI RMF are voluntary. The overview of the AI Act compared with all five frameworks sets them side by side.

Product Liability

Liability for defective AI products sits in Directive (EU) 2024/2853, which applies to products placed on the market or put into service after 9 December 2026.

The AI Act has no liability rule. The rules on AI liability in the EU follow Directive (EU) 2024/2853, in force since 8 December 2024.

Management-System Standards and Non-EU Laws

ISO/IEC 42001 and the NIST AI RMF are voluntary frameworks that give no presumption of conformity with the AI Act. The NIST AI RMF has no legal effect in the EU; ISO/IEC 42001 and the EU AI Act, NIST AI RMF vs EU AI Act and EU AI Act vs US AI laws compare them in detail.

Article 2(7) and recital 10 AI Act, Article 27(4) AI Act and the fine ceilings of Article 99(3) AI Act and Article 83(5) GDPR settle how the two regulations apply together.

Does AI Have to Comply with the GDPR?

Yes, whenever an AI system or model processes personal data: Article 2(7) AI Act confirms that Union data protection law applies to personal data processed in connection with the act. Personal data means the same in both (Article 3(50) AI Act).

Is a GDPR-Compliant AI System Compliant with the AI Act?

No: GDPR compliance covers the processing of personal data, while the AI Act adds duties that depend on the system's risk class and role, such as the Annex III high-risk requirements and Article 50 transparency.

A DPIA and a lawful basis leave these duties open. The EU AI Act checklist sorts them by role and risk class.

Frequently Asked Questions

Does the AI Act replace the GDPR?

No: Article 2(7) states that the AI Act does not affect Regulation (EU) 2016/679, and recital 10 keeps data subjects' rights. Both apply in parallel.

Is a DPIA enough for the AI Act?

No, not on its own: Article 27(4) lets a deployer cross-reference the DPIA, but the fundamental rights impact assessment has six elements of its own. It binds the deployers named in Article 27(1) from 2 December 2027.

Which regulation has the higher maximum fine?

The AI Act: its Article 99(3) ceiling for prohibited practices exceeds the Article 83(5) GDPR ceiling. Both apply "whichever is higher" to undertakings.

Did Regulation (EU) 2026/1744 amend the GDPR?

No: it amends the AI Act. GDPR changes are only proposed, in the pending COM(2025) 837.

Is using AI a breach of the GDPR?

Not in itself: the GDPR applies to the processing an AI system performs, assessed case by case.

Compiled by the AIActGuide.net Editorial Team from the Official Journal texts; how we check every statement: methodology.

Sources