EU AI Act vs GDPR

How the EU's AI-specific regulation works alongside its core data protection framework

Snelle vergelijking

Overzicht naast elkaar van de belangrijkste regelgevende dimensies

Dimensie	EU AI Act	GDPR
Primary focus	Regulating the development, deployment and use of artificial intelligence systems according to their risk level	Protecting the fundamental right to personal data protection and regulating data processing
Scope	Providers, deployers, importers and distributors of AI systems placed on the EU market or affecting people in the EU, wherever they are established	Any organisation processing personal data of individuals in the EU, wherever it is located
Risk approach	Four-tier risk classification: unacceptable (banned), high-risk (strict requirements), limited risk (transparency) and minimal risk (voluntary codes)	Risk-based approach to processing: data protection impact assessments (DPIAs) for high-risk processing, with the principles of data minimisation and purpose limitation
Transparency	AI-specific transparency: people must be told when they interact with an AI system, deepfakes must be labelled and high-risk systems need detailed technical documentation	Processing transparency: clear privacy notices, disclosure of the lawful basis and information about automated decision-making, including its logic, significance and consequences
Individual rights	Right to an explanation of high-risk AI decisions that affect a person's rights, right to complain to market surveillance authorities and protection from prohibited AI practices	Full data subject rights: access, rectification, erasure, portability, objection, restriction of processing and the right not to be subject to solely automated decisions with legal effects
Governance roles	No specific officer role, but quality management systems, conformity assessments and post-market monitoring are required for high-risk AI	Mandatory Data Protection Officer (DPO) for public authorities and for organisations doing large-scale systematic monitoring or processing sensitive data at scale
Penalties	Prohibited AI practices: up to EUR 35 million or 7% of global annual turnover; high-risk violations: up to EUR 15 million or 3%; incorrect information to authorities: up to EUR 7.5 million or 1%	Up to EUR 20 million or 4% of global annual turnover for the most serious infringements; up to EUR 10 million or 2% for less severe ones
Application timeline	Phased: prohibited practices since February 2025, general-purpose AI rules since August 2025, general application from August 2026, and high-risk obligations from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), as set by Regulation (EU) 2026/1744	Applicable since 25 May 2018, with established enforcement practice and substantial case law

Belangrijkste verschillen

Wat deze regelgeving van elkaar onderscheidt

EU AI Act
The AI Act regulates technology, the GDPR regulates data processing
The AI Act focuses on the AI system itself (its design, development and deployment) whether or not personal data is involved. The GDPR applies whenever personal data is processed, whether or not AI is used. An AI system that processes only non-personal data falls under the AI Act but not the GDPR.
GDPR
The GDPR gives individuals extensive data rights
The GDPR grants data subjects broad rights, including access, erasure (the "right to be forgotten"), portability and objection. The AI Act gives narrower individual rights, focused on transparency and explanation of high-risk AI decisions rather than control over personal data.
EU AI Act
The AI Act uses a product safety model
The AI Act borrows from EU product safety law: it sorts AI systems into risk tiers with conformity assessments, CE marking and market surveillance. This is very different from the GDPR's principles-based approach, built on lawful bases, consent and accountability.
GDPR
The GDPR has mature enforcement and case law
Since 2018, the GDPR has produced billions of euros in fines and extensive case law. The AI Act is still being phased in and has little enforcement practice yet, which leaves organisations less certain about what supervisors will expect in practice.
EU AI Act
The AI Act sets one of the highest fine ceilings in EU digital regulation
At up to EUR 35 million or 7% of global turnover for prohibited AI practices, the AI Act's top tier is well above the GDPR's highest tier of EUR 20 million or 4%. It signals that the EU treats the most dangerous AI uses as a serious threat to fundamental rights and safety.

Waar ze overlappen

Gebieden waarop beide regelingen raakvlakken hebben

Both regulate automated decision-making: GDPR Article 22 covers solely automated decisions with legal effects, while the AI Act regulates the AI systems that make those decisions
Both require transparency about how automated systems work and affect people, from different angles (data processing vs AI system behaviour)
Both mandate impact assessments: the AI Act requires fundamental rights impact assessments from certain deployers of high-risk AI, while the GDPR requires data protection impact assessments for high-risk processing
Both require organisations to set up appropriate governance and internal accountability
Both apply to organisations outside the EU that affect people in the EU

Welke is op u van toepassing?

Veelvoorkomende scenario's en welke regeling voorgaat

You are developing an AI system that processes personal data (e.g. AI-based CV screening)

Both apply at the same time. The AI Act classifies AI used in recruitment as high-risk, which requires conformity assessments and technical documentation. The GDPR requires a lawful basis for processing candidate data, a DPIA and safeguards for automated decision-making. Build both into the design from the start.

EU AI ActGDPR

You are deploying a customer-facing chatbot on your website

Under the AI Act, you must tell users they are talking to an AI system (transparency obligation). Under the GDPR, if the chatbot collects or processes personal data in conversations, you need a lawful basis, a privacy notice and a retention policy.

EU AI ActGDPR

You are building an AI system that analyses only anonymised industrial sensor data

The AI Act applies according to the system's risk level, whatever the data. The GDPR does not apply if the data is truly anonymised (not just pseudonymised). Focus on the AI Act, particularly if the system falls into a high-risk category.

EU AI Act

You process personal data with conventional software (no AI involved)

Only the GDPR applies. The AI Act covers AI systems, not conventional data processing software. Make sure you have lawful bases for processing, appropriate security and a process for data subject rights.

GDPR

Veelgestelde vragen

Veelgestelde vragen over deze regelgeving

No. The AI Act states that it applies without prejudice to the GDPR. Both run in parallel: the AI Act regulates the AI system itself, and the GDPR regulates any personal data processing that system performs. Organisations deploying AI systems that process personal data must comply with both.

GDPR Article 22 gives people the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. The AI Act adds requirements on the AI systems themselves, such as human oversight, accuracy and transparency. Together they give layered protection: the GDPR protects the person's rights, and the AI Act makes sure the system is trustworthy.

The AI Act has higher maximum fines. Prohibited AI practices can lead to fines of up to EUR 35 million or 7% of global annual turnover, against the GDPR's maximum of EUR 20 million or 4%. The GDPR, however, has a much longer enforcement record, with cumulative fines above EUR 4 billion since 2018.

The GDPR requires a DPO for certain organisations. The AI Act does not require a specific role, but organisations that develop or deploy high-risk AI should name someone responsible for AI Act compliance, particularly for conformity assessments, risk management and post-market monitoring. In practice, many organisations create AI governance roles that work with their DPO.

With Radar, Reversa's agents read the official sources for both frameworks, from AI Office guidance to data protection authority decisions, and tell you which changes affect you, and why. Compliance carries the obligations of both texts to controls, owners, deadlines and evidence, so shared work such as impact assessments and transparency notices is done once. Research answers questions across both laws, each answer traced to the article and version it relies on.