The most common assumption legal and compliance teams make when they first encounter the EU AI Act is this: “We are already GDPR compliant, so we are probably fine on AI too.” The logic is understandable. Both are EU digital regulations. Both affect how technology touches people’s lives.
The assumption is wrong. GDPR and the EU AI Act are separate legal frameworks with different scopes, different compliance documents, different regulators, and different deadlines. GDPR compliance does not transfer to the AI Act. Your organisation needs both.
The core difference in scope
GDPR regulates what you do with personal data. The regulation applies whenever you process information relating to an identified or identifiable natural person. Its rules cover how you collect, store, use, share, and retain that data. It does not matter what technology you use to process that data. A paper form, a spreadsheet, and an AI system can all be subject to GDPR if they involve personal data.
The EU AI Act regulates AI systems as technology, regardless of whether personal data is involved. If you deploy an AI system to predict machinery failures in a factory, that system may contain no personal data at all. It still falls within the scope of the AI Act. Conversely, if you run a basic database containing employee records, you have GDPR obligations but no AI Act obligations, because no AI system is involved.
This difference in scope means the two regulations address genuinely different things. They can both apply simultaneously, or either one can apply alone.
Where the two regulations do not overlap
A machinery fault prediction system that analyses sensor data without any personal data: inside the AI Act, outside GDPR.
A payroll system that stores employee salary information with no AI functionality: inside GDPR, outside the AI Act.
A simple automated email that sends a birthday discount to customers: arguably automated, but not an “AI system” under the Act’s definition. GDPR applies to the personal data processed. The AI Act does not apply.
Understanding where the regulations diverge helps you avoid over-engineering compliance for systems that only need one framework.
Where they overlap
Any AI system that processes personal data needs to satisfy both frameworks. In practice, this means a significant number of the AI tools companies use.
An AI-powered recruiting tool that processes applicants’ CVs sits inside both frameworks simultaneously. GDPR governs the lawful basis for processing applicant data, the data minimisation principles, retention limits, and applicants’ rights to access and erasure. The AI Act governs the risk classification of the system, the usage policy, the human oversight requirements, and the applicant notification obligation under Article 26.
These are not the same obligations. They are additive. Meeting GDPR does not exempt you from the AI Act, and meeting the AI Act does not exempt you from GDPR.
A comparison of what each framework requires
| GDPR | EU AI Act | |
|---|---|---|
| What it covers | Processing personal data | Deploying and using AI systems |
| Key document (deployers) | Privacy policy, ROPA, DPA | AI literacy policy, risk classification memo |
| High-risk trigger | Sensitive data categories, automated decision-making | Annex III categories (employment, credit, etc.) |
| Key deadline (deployers) | May 2018 (ongoing) | August 2026 |
| Regulator | National data protection authority | National AI authority |
| Individual rights | Access, erasure, portability, objection | Notification of AI use, human review in some contexts |
The regulators are different bodies in most EU member states. Germany’s DPA (Datenschutzkonferenz) is distinct from its AI authority (BNetzA). Non-compliance with GDPR is enforced by a different office than non-compliance with the AI Act. Having a good relationship with your DPA does not carry over.
Where GDPR goes further than the AI Act
Data minimisation: GDPR requires you to limit the personal data you collect to what is strictly necessary. The AI Act does not impose data minimisation requirements of its own.
Individual rights: GDPR gives individuals rights to access, correct, delete, and port their personal data. These rights are detailed and enforceable. The AI Act includes notification rights in high-risk contexts, but it does not create a comparable suite of individual rights over AI systems themselves.
Lawful basis: GDPR requires a lawful basis for every processing activity. Consent, contract, legal obligation, legitimate interest. The AI Act does not require a lawful basis for deploying an AI system. It requires documentation and oversight.
Where the AI Act goes further than GDPR
Human oversight: Article 26 of the AI Act requires that deployers of high-risk AI systems ensure meaningful human oversight of those systems. GDPR’s Article 22 gives individuals a right not to be subject solely to automated decision-making in limited circumstances, but this is a right the individual must exercise. The AI Act imposes the oversight requirement on the organisation, regardless of whether any individual invokes it.
System logging: The AI Act requires that high-risk AI systems retain logs to enable reconstruction of what the system did. GDPR has no equivalent logging requirement (though documentation obligations under accountability can overlap).
Applicant and user notification: Where you deploy high-risk AI in employment or customer-facing contexts, the AI Act requires proactive notification. GDPR’s transparency requirements are met through your privacy policy. The AI Act requires more specific, contextual disclosure.
The overlap that matters most: automated decision-making
Article 22 of GDPR and the employment/credit categories of Annex III of the AI Act converge on the same territory: AI systems that make or substantially inform decisions about people.
If your company uses an AI system to score job applicants, you need a GDPR Data Protection Impact Assessment (DPIA) for the personal data processing and an AI Act usage policy for the AI system. These are two separate documents addressing two separate sets of requirements. Neither replaces the other.
If you already have a DPIA for your ATS, it is a useful starting point. The DPIA analysis of what decisions the system makes, what data it uses, and what safeguards are in place will inform your AI Act documentation. But you still need the AI Act document separately.
A practical note on roles
If your organisation has a Data Protection Officer, they should be involved in your AI Act compliance work. The overlap in subject matter means that a DPO who is not in the AI Act conversation is likely producing GDPR documentation that misses the full picture of how personal data is being processed by AI systems.
Equally, if your AI Act compliance work is being done without legal privacy input, you may be meeting AI Act obligations while missing GDPR exposure from the same systems. The two tracks should talk to each other.
Get your AI Act documentation sorted separately from GDPR
Answer 20 questions about your AI systems. AIActComply generates your complete compliance documentation, prefilled for deployers, in 11 EU languages.
Check my compliance →