PricingLog in

The AI Act and the GDPR.

Reviewed

Short answer

The AI Act and the GDPR apply side by side: the AI Act regulates AI systems and models, the GDPR regulates the processing of personal data, and the AI Act says it does not affect the GDPR, apart from two specific permissions to process sensitive data (Articles 4a and 59). A deployer of a high-risk AI system can reuse its GDPR data protection impact assessment in the fundamental rights impact assessment, and must use the provider’s information when carrying out that DPIA.

Official sources: AI Act, Article 2(7) (consolidated) · Regulation (EU) 2026/1744, Articles 4a and 27

Side by side

The AI Act and the GDPR compared
AI ActGDPR
RegulatesAI systems and general-purpose AI models: what may be placed on the market or used, and howProcessing of personal data
Main rolesProvider, deployer, importer, distributorController, processor
Impact assessmentFundamental rights impact assessment for certain deployers of high-risk AI (Article 27)Data protection impact assessment where processing is likely to result in a high risk (Article 35)
Automated decisionsHuman oversight for high-risk AI (Article 14); right to explanation of individual decisions (Article 86)Right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (Article 22)
SupervisionMarket surveillance authorities; the AI Office for general-purpose AI modelsData protection authorities
Highest finesEUR 35 000 000 or 7 % of worldwide turnover (prohibited practices)EUR 20 000 000 or 4 % of worldwide turnover (Article 83(5))

Where they meet

  • Scope: “Union law on the protection of personal data … applies to personal data processed in connection with the rights and obligations laid down in this Regulation” and, except for Articles 4a and 59, the AI Act does not affect the GDPR (Article 2(7), as amended).
  • Impact assessments: if a deployer’s DPIA already meets part of the fundamental rights impact assessment, the deployer may cross-refer to it or include parts of it (Article 27(4), as amended); the AI Office is to provide a questionnaire template, including an automated tool (Article 27(5)).
  • DPIA input: deployers of high-risk AI use the information the provider gives under Article 13 for their DPIA (Article 26(9)).
  • Biometrics: the law-enforcement exception for real-time remote biometric identification is without prejudice to Article 9 GDPR for other purposes (Article 5(1), last subparagraph).
  • Logs: deployers keep high-risk logs for at least six months unless other law, in particular data protection law, provides otherwise (Article 26(6)).

Sensitive data for bias detection: the new Article 4a

The Digital Omnibus moved the permission to use special categories of personal data for detecting and correcting bias from Article 10(5) into a new Article 4a. Providers of high-risk AI may process such data exceptionally and only where strictly necessary, if six conditions are all met: other data, including synthetic or anonymised data, would not work; technical limits on re-use and state-of-the-art security, including pseudonymisation; strict access controls; no transmission to other parties; deletion once the bias is corrected or the retention period ends; and records explaining why it was strictly necessary. Providers and deployers of other AI systems may do the same under the same safeguards; the article creates no obligation to carry out bias detection.

The Commission’s Article 50 guidelines refer to joint Commission and EDPB guidelines on the interplay between the AI Act and EU data protection law as under preparation.

Questions

Does complying with the AI Act also cover the GDPR?
No. They are separate laws with separate duties and authorities; the AI Act says it does not affect the GDPR except for Articles 4a and 59. A high-risk deployer can, however, reuse parts of a DPIA in its fundamental rights impact assessment.
Do I need both a FRIA and a DPIA?
Only some deployers need a FRIA: bodies governed by public law, private entities providing public services, and deployers of credit-scoring or life and health insurance pricing systems. A DPIA follows from the GDPR when processing is likely to result in a high risk; where both apply, the FRIA may refer to the DPIA.

Sources

Last reviewed by Volkan Çatak, Founder, Proofcan.

Not legal advice. This page explains official texts in plain words and links each one; check the sources, or a lawyer, before relying on it for a decision.