Appearance
EU AI Act vs GDPR — Comparison for AI Systems Processing Personal Data
The EU AI Act (Regulation (EU) 2024/1689) and the GDPR (Regulation (EU) 2016/679) are binding EU Regulations. The two Regulations can apply at the same time to one AI system that processes personal data. This occurs only when the scope test of each Regulation is met. The scope tests are Article 2 of the EU AI Act and Articles 2 and 3 of the GDPR, each with its exclusions. One Regulation does not replace the other.
This page compares the scope, the roles, and the provisions on the same topic of the two Regulations. It also gives the sequence of the work in Modulos.
Which Regulation applies
The EU AI Act and the GDPR each have a scope test. An organization examines each test independently for each AI system.
- EU AI Act scope — The EU AI Act applies to operators and affected persons in Article 2's scope and exclusions.
- GDPR scope — The GDPR applies to personal data processing in its material scope and territorial tests, subject to its exclusions.
- DPIA — The controller's data protection impact assessment (DPIA) depends on GDPR Article 35's processing-risk test, regardless of the AI system's category.
- FRIA — EU AI Act Article 27 sets a different fundamental rights impact assessment (FRIA) test for specified deployers, applicable from 2 December 2027.
- DPIA and FRIA together — Where the two duties apply, the two assessments are necessary. Article 26(9) requires deployers of high-risk AI systems to use Article 13 information for their DPIA where applicable. Article 27(4) permits DPIA cross-references or “relevant parts thereof” in the FRIA where an Article 27 obligation “is already met through the data protection impact assessment”.
After these tests, the work of an organization can be in one Regulation or in the two:
- EU AI Act work: the duties of providers of high-risk AI systems and of providers of general-purpose AI models, and AI literacy (Article 4(1)).
- GDPR work: the legal basis (Article 6), the rights of data subjects (Articles 15 to 21), and transfers to a third country or an international organization (Chapter V).
- Work in the two Regulations: these items have duties in the EU AI Act and in the GDPR:
- a high-risk AI system that processes personal data.
- a decision to which GDPR Article 22 and EU AI Act Articles 14, 26(2), and 86 apply.
- an incident that is a serious incident (Article 73) and also a personal data breach (Articles 33 and 34).
For the items of each Regulation, see Duties with no counterpart in the other Regulation.
Summary
The EU AI Act and the GDPR set rules for different objects, and the two Regulations can apply to one AI system:
- EU AI Act — The EU AI Act sets rules for AI systems and general-purpose AI models (Article 1(2)). The role of the operator and the category of the system or the model set its duties.
- GDPR — The GDPR sets rules on the protection of natural persons with regard to the processing of personal data (Article 1(1)). Its territorial scope is in Article 3.
- Relation — One Regulation does not replace the other. EU AI Act Article 2(7) applies Union data protection law to personal data processed in connection with the EU AI Act. Article 2(7) also gives this rule: “Without prejudice to Articles 4a and 59 of this Regulation, this Regulation shall not affect Regulation (EU) 2016/679”. Article 4a is about the processing of special categories of personal data for “bias detection and correction”. Article 59 is about the “processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox”. Each of the two Articles applies on its conditions. See Article 2(7) — data protection.
- Compliance — GDPR compliance does not make an AI system compliant with the EU AI Act. EU AI Act compliance does not make the processing compliant with the GDPR. One practice can be useful for related duties of the two Regulations, but each Regulation keeps its own actor, condition, remedy, and authority.
- Roles — The EU AI Act has operator roles, for example provider and deployer (Article 3(8)). The GDPR has the controller (Article 4(7)) and the processor (Article 4(8)). An organization can hold roles in the two Regulations at the same time. See Roles in the EU AI Act and the GDPR.
The two Regulations side by side
The table compares the EU AI Act and the GDPR. The links go to the sections with the full rules.
| Item | EU AI Act | GDPR |
|---|---|---|
| Adopted by | The European Parliament and the Council | The European Parliament and the Council |
| Dates | Applies from 2 August 2026, with exceptions and transitions. Chapter III, Sections 1 to 3, with the exception of Article 6(5), applies from 2 December 2027 (Article 6(2)/Annex III) or 2 August 2028 (Article 6(1)/Annex I). | Applies from 25 May 2018 (Article 99): see Dates and rules of the GDPR. |
| Subject | AI systems and general-purpose AI models (Article 1(2)) | The processing of personal data (Article 1(1)) |
| Roles | Operators (Article 3(8)): provider, deployer, importer, distributor, product manufacturer, authorized representative | Controller (Article 4(7)) and processor (Article 4(8)) |
| Legal categories | Article 5, Article 6 with Annexes I and III, Article 50, and Chapter V. See Categories of AI systems. | No categories of AI systems. The DPIA test of Article 35(1) is the risk of a type of processing to the rights and freedoms of natural persons. |
| Scope | Article 2(1) operators and persons, with the exclusions of Article 2 | Material scope with exclusions (Article 2) and three territorial tests (Article 3) |
| Conformity and certification | Conformity assessment and CE marking for high-risk AI systems (Articles 16(f) and (h), 43, 44, and 48). See Conformity assessment and CE marking. | No conformity assessment. The controller is responsible for compliance with the principles and must be able to show it (Article 5(2)). Certification of processing operations is not mandatory (Article 42(3)). Certification bodies or the supervisory authority issue it, for a maximum of three years (Article 42(5) and (7)). See Articles 40 to 43. |
| Documentation | Providers of high-risk AI systems: technical documentation (Article 11 and Annex IV), a quality management system (Article 17), and a post-market monitoring system (Article 72) | Controllers and processors: records of processing activities (Article 30). Article 30(5) exempts an enterprise or organization with fewer than 250 persons, on its conditions. The controller: a DPIA where Article 35 applies. |
| Oversight and automated decisions | Human oversight of high-risk AI systems (Articles 14 and 26(2)) and the right to explanation (Article 86) | The right not to be subject to a decision based solely on automated processing, with the conditions of Article 22(2) and (3). See GDPR Article 22 and EU AI Act Articles 14 and 86. |
| Transparency | Information to deployers (Article 13) and transparency obligations of providers and deployers of some AI systems (Article 50) | Information to data subjects (Articles 13 and 14) |
| Authorities | National competent authorities (Article 70), with different Commission and AI Office powers in Article 75 (as amended by Regulation (EU) 2026/1744) and Article 88. | Member State supervisory authorities monitor compliance with the GDPR (Article 51). The European Data Protection Board makes sure that the GDPR is applied consistently (Article 70): see Supervisory authorities. |
| Maximum fines | Article 5: up to EUR 35 000 000 or, for an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, “whichever is higher” (Article 99(3)). Article 99(4), for example Articles 16, 26, and 50: up to EUR 15 000 000 or 3%, on the same rule. The supply of “incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request”: up to EUR 7 500 000 or 1% (Article 99(5)). For micro, small and medium-sized enterprises (SMEs), each fine has the lower of the two values as its maximum (Article 99(6)). For small mid-cap enterprises (SMCs), the same rule applies to Article 99(4) and (5) (Article 99(6a)). The Commission can fine providers of general-purpose AI models (Article 101). See Penalties and enforcement. | Article 83(5) and (6): up to EUR 20 000 000 or, for an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, “whichever is higher”. Article 83(4), for example Articles 25 to 39: up to EUR 10 000 000 or 2%, on the same rule. See Administrative fines and other penalties. |
The EU AI Act and the GDPR have different provisions for their authorities (EU AI Act Article 70, GDPR Article 51). EU AI Act Article 74(8) connects the two for these high-risk AI systems in Annex III:
- the systems in point 1 of Annex III, as far as they are used for law enforcement purposes, border management, and justice and democracy.
- the systems in points 6, 7, and 8 of Annex III.
For these systems, Member States designate as market surveillance authorities the competent data protection supervisory authorities of the GDPR or of Directive (EU) 2016/680. A Member State can also designate a different authority on the conditions of Articles 41 to 44 of that Directive.
Provisions on the same topic
The EU AI Act and the GDPR have provisions on the same topics. The table below is the mapping of this page, and the two Regulations do not contain it. The provisions in one row can have different actors, conditions, and remedies. A practice can be useful for the duties in one row, but each Regulation keeps its own duty.
| Topic | EU AI Act | GDPR | Shared practice (this page's mapping) |
|---|---|---|---|
| Data governance | Article 10 (data and data governance for high-risk AI systems) | Article 5(1)(c) and (d) (data minimization, accurate personal data) | Records of the data sources and the data quality checks of each AI system |
| Transparency | Article 13: information to deployers. Article 50(1): providers make sure that natural persons know when they interact with an AI system, on the conditions of Article 50(1). Article 50(3): deployers tell exposed persons about the operation of emotion recognition or biometric categorization systems, subject to the criminal-law exception and its conditions. The paragraph also names the GDPR, Regulation (EU) 2018/1725, and Directive (EU) 2016/680 for personal data processing, each as applicable. Article 26(11): some deployers of Annex III high-risk AI systems tell natural persons that the system is in use for them. These are deployers that make decisions about those persons, or help to make them. | Articles 13 and 14: information to data subjects | Instructions for use, information for deployers, and a privacy notice for data subjects |
| Oversight and automated decisions | Article 14 (human oversight of high-risk AI systems), Article 26(2) (deployers “assign human oversight to natural persons”), and Article 86 (right to explanation) | Article 22, with the conditions of Article 22(2) and the safeguards of Article 22(3) | An oversight procedure with roles and escalation |
| Records | Article 12(1): high-risk AI systems “shall technically allow for the automatic recording of events (logs)”. Article 26(6): deployers keep the logs “to the extent such logs are under their control”. | Article 30: a written record of processing activities | Two different records: the logs come from the AI system, and the record of processing activities is a written document |
| Risk management, FRIA, and DPIA | Article 9: a risk management system for each high-risk AI system. Providers make sure that their high-risk AI systems are “compliant with the requirements set out in Section 2” (Article 16(a)). Article 27: the FRIA of some deployers. | Article 35: the DPIA of the controller | An organization with more than one role can do the risk management, the FRIA, and the DPIA together. Article 27(4) lets the deployer refer to its DPIA. |
| Incidents | Article 73(1): providers of high-risk AI systems placed on the Union market report serious incidents. They report to the market surveillance authorities of the Member States where the incident occurred. | Article 33(1): the controller notifies a personal data breach to the supervisory authority, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Article 34: communication by the controller to data subjects for breaches likely to result in high risk to their rights and freedoms, subject to Article 34(3)'s exceptions. | One incident record with two different notification procedures |
| Cybersecurity and security of processing | Article 15 (“Accuracy, robustness and cybersecurity”) | Article 32 (security of processing) | An information security management system for the AI system, for example one based on ISO/IEC 27001 |
The two incident duties have different actors, recipients, and times. The two Regulations have no provision that tells the organization to connect the two notifications. For the times, see Article 73 — serious-incident reporting and Article 33 — controller breach notification.
GDPR Article 22 and EU AI Act Articles 14 and 86
GDPR Article 22 gives data subjects a right not to be subject to a solely automated decision “which produces legal effects concerning him or her or similarly significantly affects him or her”, subject to its exceptions and safeguards. EU AI Act Articles 14 and 26(2) set human oversight duties for high-risk AI systems and their deployers, on their own conditions and dates. Article 86 gives affected persons a different, conditional right to explanations from the deployer: see Article 22 and the EU AI Act.
Duties with no counterpart in the other Regulation
The EU AI Act and the GDPR each have duties that the other Regulation does not have.
EU AI Act duties with no GDPR counterpart
The EU AI Act has these duties, and the GDPR has no equivalent:
- Categories of AI systems — The EU AI Act has prohibited practices, high-risk AI systems, and transparency obligations in Articles 5, 6, and 50, with cumulative duties where applicable.
- Conformity assessment and CE marking — Providers of high-risk AI systems have conformity assessment and CE marking duties in Articles 16(f) and (h), subject to the applicable dates.
- Quality management system — Article 17 sets a quality management system duty for providers of high-risk AI systems, subject to its applicable dates and sector-specific provisions.
- Post-market monitoring — Article 72 sets a post-market monitoring duty for providers of high-risk AI systems during the systems' lifetime.
- General-purpose AI models — Article 53 provider duties, Article 55 systemic-risk duties, and Article 56 codes of practice are for providers of general-purpose AI models.
- AI literacy — Article 4(1) requires providers and deployers of AI systems to “take measures to support the development of AI literacy” of “their staff and other persons dealing with the operation and use of AI systems on their behalf”, without a duty to guarantee “any specific level”.
GDPR duties with no EU AI Act counterpart
The GDPR has these duties, and the EU AI Act has no equivalent:
- Legal basis — Article 6(1) sets conditions for lawful processing that apply to personal data processing, also when AI systems process the data.
- Principles — The Article 5 principles apply in the GDPR's scope regardless of an AI system's category in the EU AI Act.
- Rights of data subjects — Articles 15 to 21 give conditional rights concerning personal data that the controller processes, also when AI systems process the data.
- Transfers — Chapter V sets conditions for transfers of personal data by controllers and processors to a third country or an international organization.
Roles in the EU AI Act and the GDPR
The EU AI Act and the GDPR have different roles. The table below is the mapping of this page. The facts of the processing of personal data set the GDPR role of each EU AI Act operator.
| EU AI Act role | GDPR role | What sets the GDPR role |
|---|---|---|
| Provider (Article 3(3)): a person or body that “develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark” | Controller, processor, or no GDPR role | The provider sets the intended purpose of the AI system (Article 3(12)). The provider is a controller only if it determines the purposes and means of the processing of personal data (GDPR Article 4(7)). |
| Deployer (Article 3(4)): a person or body “using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity” | Controller or processor | A deployer is a controller if it determines the purposes and means of the processing (GDPR Article 4(7)). A deployer that processes personal data on behalf of a controller is a processor (GDPR Article 4(8)). |
| Importer (Article 3(6)) and distributor (Article 3(7)) | Controller, processor, or no GDPR role | How the importer or the distributor handles personal data sets its GDPR role. |
One organization can have more than one role in the two Regulations for the same AI system.
The EU AI Act and the GDPR in Modulos
In Modulos, the EU AI Act and the GDPR are different Frameworks at each level:
| Level | EU AI Act | GDPR | Controls that the two Frameworks share |
|---|---|---|---|
| Organization | OFF-1 | OFF-11 | 1 |
| AI System | MFF-1 | MFF-12 | 0 |
At Organization level, the one shared Control is 6% of the OFF-1 Controls and 2% of the OFF-11 Controls.
Add the Organization-level Frameworks to the organization AI System. For setup help, see the EU AI Act steps. Add each AI System-level Framework to the AI Systems in the scope of its Regulation.
Requirements of more than one Framework can map the same Control. A shared Control does not make a Requirement of the other Framework Fulfilled. The Requirement Owner reviews each Requirement and marks it Fulfilled. For the shared Controls of all Frameworks, see Control overlap.
1
Scope
Test the scope of the EU AI Act and the GDPR
2
Roles
Set your role in each Regulation
3
Classify
Classify the AI system. Find if a DPIA is necessary.
4
Assess
Do the DPIA, and the FRIA where Article 27 applies
5
Frameworks
Add the Frameworks at each level
6
Monitor
Monitor each duty on its own conditions
For the Requirements and the steps of each Framework, see EU AI Act Requirements and provisions and GDPR Frameworks in Modulos.
Where to go next
EU AI Act
Prohibited AI practices, high-risk AI systems, conformity assessment, and post-market monitoring.
GDPR
Principles, roles, the DPIA, and the duties of controllers and processors.
AI governance frameworks compared
The legal status and the scope of each framework that these pages document.
Control overlap
The Controls that two Modulos Frameworks share, at each level.
Frequently asked questions
Short answers that compare frameworks, standards, and laws. Each answer gives the section with the full rule.
How to comply with the EU AI Act
The steps to prepare for the EU AI Act.
Sources of this page
- EU AI Act, Regulation (EU) 2024/1689, consolidated text of 27 July 2026 (EUR-Lex). Articles 1 to 4: 1(2), 2(1), (3), (6), and (7), 3(3), (4), (6), (7), (8), (12), (14a), and (14b), and 4(1). Articles 5 to 50: 5, 6, 9 to 17, 26(2), (6), (9), and (11), 27(1) and (4), 43, 44, 48, and 50(1), (3), and (6). Articles 53 to 75: 53(1)(b) and (2), 55, 56, 70(1), 72(1) and (2), 73(1), 74(8), and 75(1). Articles 86 to 113: 86, 88(1), 99(3) to (6a), 101, and 113.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L, 24.7.2026 (EUR-Lex): the amendments to EU AI Act Articles 4 and 75.
- GDPR, Regulation (EU) 2016/679, OJ L 119, 4.5.2016, p. 1, and its corrigendum, OJ L 127, 23.5.2018, p. 2 (EUR-Lex). Articles 1 to 22: 1(1), 3, 4(7) and (8), 5, 6(1), 13, 14, 15 to 21, and 22. Articles 30 to 35: 30(5), 32, 33(1), 34(1) and (3), and 35(1). Articles 42 to 99: 42(3), (5), and (7), 44, 51(1), 70(1), 83(4) to (6), and 99.
- Directive (EU) 2016/680 (Law Enforcement Directive), OJ L 119, 4.5.2016, p. 89 (EUR-Lex): Articles 41 to 44.
Disclaimer
This page gives general information. It is not legal advice.