How GDPR Played Out, and What It Teaches About the AI Act

Seven lessons from the GDPR text and enforcement decisions, and where the EU AI Act differs.

By ScanaraPublished 20 March 2026· Updated 26 October 2026

Key Takeaways

1.The General Data Protection Regulation (GDPR) has applied since 25 May 2018. Fines of EUR 50 million (Google, January 2019) to EUR 1.2 billion (Meta, May 2023; pending appeal) came later. AI Act penalty rules (Article 99) apply since 2 August 2025 (Article 113). High-risk duties (Articles 8 to 27) apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Fines for them cannot come earlier, because Article 99(4) lists the duties themselves (for example Article 16 on providers and Article 26 on deployers). Annex III lists high-risk uses such as hiring or credit scoring. Annex I lists the Union harmonisation legislation for products (Article 6(1)). Section B of Annex I lists other Union harmonisation legislation. Articles 8 to 27 do not apply to high-risk systems related to those products (Article 2(2)).
2.Both laws reach companies outside the EU, with different tests. GDPR Article 3(2) covers offering goods or services to people in the Union or monitoring their behaviour. AI Act Article 2(1) covers providers that place systems on the Union market. It also covers companies elsewhere whose system output is used in the Union.
3.Both laws apply at once to an AI system that processes personal data (AI Act Article 2(7)). Providers and deployers must meet both. Deployers use an AI system under their authority, except for personal non-professional use (Article 3(4)).
4.GDPR fines reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5)). Banned practices carry AI Act fines up to EUR 35 million or 7% of worldwide turnover, whichever is higher (Article 99(3)). High-risk duties of providers and deployers carry AI Act fines up to EUR 15 million or 3% of worldwide turnover, whichever is higher (Article 99(4)). For small and medium-sized enterprises (SMEs), each fine is up to the lower of the two amounts (Article 99(6)). Article 3(14a) defines SMEs. Both laws list mitigation, cooperation and the measures taken as factors when authorities set the amount (GDPR Article 83(2); AI Act Article 99(7)).

Next step: list the AI systems that process personal data and map their roles under both laws.

Lesson 1: GDPR fines of EUR 50 million to EUR 1.2 billion came within five years

The GDPR has applied since 25 May 2018. These fines followed:

Google, EUR 50 million (French data protection authority CNIL, January 2019). The Conseil d’État upheld the fine in June 2020.
Amazon, EUR 746 million (Luxembourg data protection authority CNPD, July 2021). On 12 March 2026 the Luxembourg Cour administrative annulled the decision and sent it back to the CNPD. The court found that the CNPD had not assessed fault and had not properly chosen the corrective measure. The court largely confirmed the violations the CNPD had found.
WhatsApp, EUR 225 million (Irish Data Protection Commission, DPC, August 2021). The DPC fines page (updated 21 September 2026) lists the fine as “Pending Appeal”.
Meta, EUR 1.2 billion (Irish DPC, May 2023). The DPC fines page (updated 21 September 2026) lists the fine as “Pending Appeal”.

We cannot predict when authorities will first fine under the AI Act

Member States lay down the penalty rules (Article 99(1)), and national authorities weigh each case (Article 99(7)).

Lesson 2: Compliance travels through contracts and documents

GDPR Article 28(3) governs processors (bodies that process personal data on behalf of the controller, Article 4(8)). It requires a contract or other legal act that binds the processor to the controller.

The AI Act also moves obligations along the supply chain. High-risk systems must come with instructions for use for deployers (Article 13(2)). Providers of general-purpose AI models (models that can competently perform a wide range of distinct tasks, Article 3(63)) must provide documentation. They give it to providers that integrate the model into AI systems (Article 53(1)(b)). Those providers are downstream providers (Article 3(68)). Article 25(4) requires a written agreement between the provider of a high-risk system and third parties that supply AI systems, AI models, tools, services, components or processes for it. The rule does not apply to third parties that make tools, services, processes or components, other than general-purpose AI models, publicly accessible under a free and open-source licence.

The AI Act requires documents and written agreements along the AI supply chain, on different dates

Article 53(1)(b) applies since 2 August 2025. Articles 13 and 25(4) apply from 2 December 2027 (Annex III) or 2 August 2028 (Annex I, except Section B products; Article 2(2)).

Lesson 3: Both laws reach companies outside the EU

GDPR Article 3(2) reaches organisations outside the EU that offer goods or services to people in the Union or monitor their behaviour. The fines in Lesson 1 fell on four companies: Google LLC, Amazon Europe Core S.à r.l., WhatsApp Ireland Ltd and Meta Platforms Ireland Limited. The last three are EU-based, so these fines do not show Article 3(2) at work.

The AI Act uses a different test. Article 2(1)(c) covers providers and deployers established in a third country where the system’s output is used in the Union. Article 2(1)(a) covers providers who place AI systems on the Union market wherever they are established.

Third-country providers of high-risk systems and of general-purpose AI models must appoint an authorised representative in the Union (Articles 22 and 54)

Providers of high-risk systems established in third countries must appoint an authorised representative in the Union by written mandate (Article 22(1)). An authorised representative is a natural or legal person located or established in the Union. It has received and accepted a written mandate from a provider to perform and carry out on its behalf the obligations and procedures established by this Regulation (Article 3(5)). Article 22 applies from 2 December 2027 (Annex III) or 2 August 2028 (Annex I, except Section B products; Article 2(2)). Providers of general-purpose AI models established in third countries must do the same before placing the model on the Union market (Article 54(1)). Article 54 applies since 2 August 2025. Providers of models placed on the market before that date must take the necessary steps to comply with the obligations by 2 August 2027 (Article 111(3)). Article 54(6) exempts providers of general-purpose AI models released under a free and open-source licence that allows access, usage, modification and distribution of the model. Their parameters, architecture information and usage information must be publicly available. The exemption does not apply to models that present systemic risks (risks specific to the high-impact capabilities of general-purpose AI models, Article 3(65)).

Lesson 4: Build compliance into engineering

GDPR Article 25 requires data protection by design and by default. The controller (the body that determines the purposes and means of the processing, Article 4(7)) implements appropriate technical and organisational measures. It does so when it determines the means of processing and during the processing itself (Article 25(1)).

The AI Act sets design requirements for high-risk systems. Article 12(1) requires that they technically allow the automatic recording of events (logs). Article 14(1) requires that they are designed so that natural persons can effectively oversee them. Article 15(1) requires an appropriate level of accuracy, robustness and cybersecurity. The risk management system runs throughout the entire lifecycle (Article 9(2)).

Lesson 5: Both laws apply at the same time

Without prejudice to Articles 4a and 59, the AI Act does not affect the GDPR (Article 2(7)). An AI system that processes personal data must meet both laws.

Three topics appear in both laws. The first is automated decisions and human oversight (GDPR Article 22; AI Act Article 14). The second is transparency (GDPR Articles 13 and 14; AI Act Articles 13 and 50). The third is impact assessments. GDPR Article 35 requires an assessment of the impact on the protection of personal data where processing is likely to result in a high risk. AI Act Article 27 requires an assessment of the impact on fundamental rights. It applies to deployers that are bodies governed by public law or private entities providing public services. It also applies to deployers of systems in Annex III points 5(b) and (c). Systems in the area of Annex III point 2 are excluded.

Lesson 6: Both laws weigh the measures you took when they set a fine

GDPR Article 83(2) lists the factors an authority considers when it sets a fine. They include measures taken to mitigate damage, the degree of responsibility given the technical and organisational measures, and cooperation with the supervisory authority.

AI Act Article 99(7) lists similar factors. They include the degree of cooperation (f) and the degree of responsibility given the technical and organisational measures (g). They also include how the infringement became known (h) and action taken to mitigate harm (j).

Keep records of the measures you take

Article 99(7)(g) makes the technical and organisational measures an operator implemented a factor when authorities set a fine. Records do not remove the duty to comply from 2 December 2027 (Annex III) or 2 August 2028 (Annex I, except Section B products; Article 2(2)).

Lesson 7: The legal duty stays with the organisation

The GDPR created duties for consent (Article 7), records of processing (Article 30) and impact assessments (Article 35). The controller stays responsible for them (Article 24).

The AI Act works the same way. The duty stays with the provider of a high-risk system (Article 16) and its deployer (Article 26).

The GDPR applied all at once; AI Act duties apply in stages from 2025 to 2028

Phase	GDPR	AI Act
Adopted	April 2016	June 2024
Entry into force	May 2016	August 2024
First obligations	25 May 2018 (all at once)	2 February 2025 (prohibited practices and AI literacy; exception: Article 5(1)(ba), (bb), (1a) and (1b), added by Regulation (EU) 2026/1744, apply from 2 December 2026); 2 August 2025 (general-purpose AI model duties and penalty rules, except Article 101); 2 August 2026 (Article 101 fines on providers of general-purpose AI models)
Main duties apply (AI Act: high-risk systems)	25 May 2018	2 December 2027 (Annex III) and 2 August 2028 (Annex I, except Section B products; Article 2(2))
Max fine (turnover %)	EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5))	Banned practices: EUR 35 million or 7% of worldwide annual turnover, whichever is higher (Article 99(3)). High-risk duties of providers and deployers: EUR 15 million or 3%, whichever is higher (Article 99(4)). SMEs: the lower of the two amounts (Article 99(6)). Small mid-cap enterprises (Article 3(14b)): the same for fines under Article 99(4) and (5) (Article 99(6a)).
Applies outside the EU	Yes (Article 3(2))	Yes (Article 2(1)(a) and (c))

Sources & References

Frequently Asked Questions

What did GDPR enforcement look like in practice?

The General Data Protection Regulation (GDPR) has applied since 25 May 2018. These fines followed. Google, EUR 50 million (French data protection authority CNIL, January 2019). The Conseil d’État upheld the fine in June 2020. Amazon, EUR 746 million (Luxembourg data protection authority CNPD, July 2021). On 12 March 2026 the Luxembourg Cour administrative annulled the decision and sent it back to the CNPD. The court found that the CNPD had not assessed fault and had not properly chosen the corrective measure. The court largely confirmed the violations the CNPD had found. WhatsApp, EUR 225 million (Irish Data Protection Commission, DPC, August 2021). The DPC fines page (updated 21 September 2026) lists the fine as “Pending Appeal”. Meta, EUR 1.2 billion (Irish DPC, May 2023). The DPC fines page (updated 21 September 2026) lists the fine as “Pending Appeal”. Status as of 26 October 2026; the sources are listed on this page.

Does the AI Act replace GDPR?

No. Without prejudice to Articles 4a and 59, the AI Act does not affect the GDPR (Article 2(7)). The GDPR regulates the processing of personal data. The AI Act regulates AI systems and general-purpose AI models. An AI system that processes personal data must meet both.

How similar are GDPR and AI Act compliance processes?

They overlap on impact assessments. Where applicable, a deployer of a high-risk system must use the provider’s Article 13 information for its data protection impact assessment (GDPR Article 35; AI Act Article 26(9)). Any obligation in Article 27 may already be met through the data protection impact assessment. Then the deployer may cross-refer to it or include parts of it in the fundamental rights impact assessment (Article 27(4)).

How much time is there before the AI Act duties apply?

Duties for Annex III high-risk systems (Articles 8 to 27) apply from 2 December 2027. For Annex I systems they apply from 2 August 2028 (Article 113). Regulation (EU) 2026/1744 moved these dates; the earlier dates were 2 August 2026 and 2 August 2027. Section B of Annex I lists other Union harmonisation legislation. For high-risk systems related to those products, only Article 6(1), Article 60a and Articles 102 to 112 apply (Article 2(2)). Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems have been integrated in that legislation.

Who enforces the AI Act?

National market surveillance authorities (the authorities that act under Regulation (EU) 2019/1020, as defined in AI Act Article 3(26)) enforce the AI Act (Articles 70 and 74). The Commission has exclusive powers to supervise and enforce the rules for general-purpose AI models and entrusts the tasks to the AI Office (Article 88(1)). The AI Office is also exclusively competent for AI systems based on a general-purpose AI model. This applies where the same provider, or providers in the same undertaking, developed the model and the system. Article 75(1)(a), as replaced by Regulation (EU) 2026/1744, lists four exceptions. Article 75(1)(b) also makes the AI Office exclusively competent for AI systems that are, or are integrated into, a very large online platform or very large online search engine. The platform or search engine must be designated under Regulation (EU) 2022/2065. Member States decide how fines apply to public authorities (Article 99(8)).

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.

See how Scanara scans your repos