EU AI Act vs GDPR: What's Different, What Overlaps
How the EU AI Act and the GDPR differ in scope, duties, fines and enforcement, and where they overlap.
Providers and deployers of AI systems that process personal data in the EU must follow both the EU AI Act and the GDPR. Without prejudice to Articles 4a and 59, the AI Act does not affect the GDPR (Article 2(7)).
The GDPR has applied since 25 May 2018. The AI Act applies in stages from 2 February 2025. AI Act fines reach EUR 35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)). GDPR fines reach EUR 20 million or 4%, whichever is higher (Article 83(5)). Next step: map each AI system’s roles under both laws.
The two laws differ in scope, risk approach, duties, fines and enforcement
| Topic | EU AI Act | GDPR |
|---|---|---|
| Scope | AI systems placed on the market or put into service in the EU, GPAI models placed on the EU market, deployers established or located in the EU, and providers and deployers elsewhere whose system’s output is used in the EU (Article 2(1)) | Processing of personal data in the context of the activities of an establishment of a controller or processor in the EU, and processing of data of people in the EU by others who offer them goods or services or monitor their behaviour in the EU (Article 3) |
| Risk approach | Rules by risk: banned practices (Article 5), high-risk systems (Article 6) and transparency duties (Article 50), plus separate rules for GPAI models | Duties scale with risk. A data protection impact assessment (DPIA) is required for processing likely to result in a high risk (Article 35) |
| Key duties | For high-risk systems: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity (Articles 9 to 15) | A lawful basis, purpose limitation, data minimisation and the rights of data subjects (Articles 5, 6 and 12 to 22) |
| Maximum fines | Up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)) | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (Article 83(5)) |
| Enforcement | National market surveillance authorities. The Commission’s AI Office is exclusively competent for GPAI models and for some AI systems: those built on a GPAI model by the same provider (with exceptions) and those integrated into very large online platforms or search engines (Articles 75 and 88) | National data protection (supervisory) authorities (Article 51) |
| Application date | In stages from 2 February 2025 to 2 August 2028, with some dates up to 2 August 2030 (Article 113) | Since 25 May 2018 (Article 99(2)) |
These areas overlap, and both laws apply in each
Automated decisions
GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects, subject to the exceptions in Article 22(2). The AI Act requires high-risk systems to allow effective human oversight (Article 14). It also gives a person affected by a deployer’s decision based on the output of an Annex III high-risk system (except critical infrastructure) a right to an explanation, where the decision has legal or similarly significant effects that the person considers adverse for their health, safety or fundamental rights. This applies only to the extent that Union law does not already provide that right (Article 86).
Transparency
The GDPR requires controllers to tell people how their data is processed (Articles 13 and 14). The AI Act requires providers to give deployers instructions for use of high-risk systems (Article 13), and requires notices to people for some systems (Article 50). Both can apply to the same system.
Data quality and bias
GDPR Article 5(1)(d) requires personal data to be accurate. The AI Act requires training, validation and testing data of high-risk systems to meet quality criteria, including an examination for possible bias (Article 10). Providers may exceptionally process special categories of personal data to detect and correct bias, under strict conditions (Article 4a).
Impact assessments
Where applicable, deployers of high-risk systems use the provider’s Article 13 information for their GDPR data protection impact assessment (Article 26(9)). A fundamental rights impact assessment under Article 27 can cross-refer to that assessment (Article 27(4)).
These differences decide what you must do under each law
What is regulated
The GDPR regulates the processing of personal data. The AI Act regulates AI systems and general-purpose AI models, whether or not they process personal data.
Who bears the obligations
The GDPR addresses controllers and processors. The AI Act addresses providers, deployers, importers, distributors and other operators. The roles do not map one to one, so check each law’s definitions (AI Act Article 3, GDPR Article 4).
Documentation requirements
The GDPR requires records of processing activities (Article 30) and data protection impact assessments (Article 35). The AI Act requires technical documentation (Article 11), a conformity assessment (Article 43) and, for some deployers, a fundamental rights impact assessment (Article 27). One does not replace the other.
Frequently Asked Questions
Does following the GDPR satisfy the AI Act?
No. The AI Act sets separate duties, such as risk management for high-risk systems (Article 9) and technical documentation (Article 11). Without prejudice to Articles 4a and 59, the AI Act does not affect the GDPR (Article 2(7)), so both laws apply.
Can two authorities act on the same AI system?
Yes. A data protection authority enforces the GDPR and a market surveillance authority enforces the AI Act, each within its own law. When an authority sets an AI Act fine, it considers fines that other authorities already imposed for the same activity (Article 99(7)(c)).
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.