Comparison
GDPR vs EU AI Act
Written with AI from the sources below and checked against our facts sheet. Last checked . How this site is made · Spot an error?
Part of: EU AI Act
The one-line rule
The GDPR protects people whenever their personal data is processed, by any technology. The EU AI Act regulates AI systems by risk, with or without personal data. Many AI projects must meet both.
Side by side
| GDPR | EU AI Act | |
|---|---|---|
| Official name | Regulation (EU) 2016/679 | Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744 |
| Applies from | 25 May 2018 | In stages, from 2 Feb 2025 to 2 Aug 2028 |
| What it regulates | Processing of personal data, by any technology | AI systems and general-purpose AI models, by risk |
| Trigger | Personal data is processed | An AI system or GPAI model is placed on the EU market, put into service or used |
| Main roles | Controller and processor | Provider, deployer, importer, distributor, authorized representative |
| Logic | Principles and individual rights | Product safety plus fundamental rights, in risk tiers |
| Key assessment | DPIA by the controller (Art. 35) | Conformity assessment by the provider (Art. 43); FRIA by some deployers (Art. 27) |
| Automated decisions | Art. 22 limits solely automated decisions with legal or similarly significant effects | Art. 14 human oversight by design; Art. 86 right to an explanation |
| Regulators | Data protection supervisory authorities | Market surveillance authorities; the AI Office for GPAI models |
| Maximum fine | €20 million or 4% of worldwide annual turnover | €35 million or 7% of worldwide annual turnover |
| Reach outside the EU | Yes, when offering goods or services to, or monitoring, people in the EU (Art. 3) | Yes, when AI is placed on the EU market or its output is used in the EU (Art. 2) |
When each applies
The GDPR applies whenever personal data is processed, whether by a spreadsheet or a neural network. Training, fine-tuning and running a model on personal data each need a lawful basis. Notices, data minimization, data subject rights and, for high-risk processing, a DPIA all apply.
The AI Act applies to AI systems and models according to their risk tier, even with no personal data. It bans some practices (Art. 5) and sets strict rules for high-risk systems. It requires transparency for chatbots and deepfakes (Art. 50) and leaves minimal-risk AI largely alone. See the EU AI Act hub.
Both apply to most AI that touches people, and the AI Act builds bridges:
- Art. 2(7) says the Act does not affect the GDPR, without prejudice to Art. 4a and the sandbox rules in Art. 59. The Digital Omnibus swapped an older reference to Art. 10(5) for Art. 4a.
- Art. 4a lets providers, and in some cases deployers, process special-category data where strictly needed to detect and correct bias. It takes over from the deleted Art. 10(5).
- Art. 26(9) tells deployers to use the provider's instructions when doing their DPIA.
- Art. 27(4) lets a FRIA cross-reference or include DPIA sections. See FRIA vs DPIA.
- Art. 86(3) makes the AI Act's right to an explanation apply only where EU law, such as the GDPR, does not already provide it.
Roles often line up, but not always. A provider is often the controller of its training data. A deployer is often the controller of the data it feeds the system. A vendor running the system for a client is often that client's processor.
Worked example
Talvio Recruiting, a fictional Finnish staffing firm, plans to use Rankwell's AI tool to rank job applicants. Rankwell is a fictional vendor.
Under the AI Act, ranking candidates is an Annex III point 4(a) use, so the tool is a high-risk AI system. Rankwell is the provider. It owes the Arts. 9 to 15 requirements, a conformity assessment, CE marking and registration. Talvio is the deployer. It must use the tool as instructed, assign trained human oversight and keep logs for at least six months. It must also tell candidates a high-risk system is used. These duties apply from 2 December 2027. Talvio is a private firm outside the credit and insurance cases, so it needs no FRIA.
Under the GDPR, Talvio is the controller of candidate data. It needs a lawful basis and clear notices. Ranking candidates is evaluation that significantly affects them, so a DPIA is likely required. If any rejection were fully automated, Art. 22 would apply, with its right to human intervention. Rankwell is likely Talvio's processor for candidate data, under a contract that meets Art. 28.
Talvio runs one combined review. Its DPIA draws on Rankwell's instructions for use, as Art. 26(9) envisages.
The exam trap
The classic trap is treating compliance with one law as compliance with the other. A clean DPIA does not make a high-risk system conform. A CE-marked system can still process data unlawfully.
The tells:
- Personal data, a controller and a lawful basis point to the GDPR.
- A risk tier, a provider and a conformity assessment point to the AI Act.
- €20 million or 4% is the GDPR. The AI Act's tiers are 35/7, 15/3 and 7.5/1.
- "The AI Act applies only to personal data" is wrong. So is "the GDPR doesn't cover AI."
- Data protection authorities enforce the GDPR. Market surveillance authorities and the AI Office enforce the AI Act.
Drill the risk pyramid in lesson II.C.1, lawful basis in lesson II.A.1 and DPIAs in lesson II.A.3.
Frequently asked questions
Does the EU AI Act replace the GDPR?
No. Art. 2(7) of the AI Act says it does not affect the GDPR, without prejudice to two provisions: the new Art. 4a on bias-detection data and the sandbox rules in Art. 59. Any AI system that processes personal data must still meet the GDPR in full. The AI Act adds product-safety and fundamental-rights duties on top.
Can a DPIA count as a FRIA?
Partly. Since the 2026 Digital Omnibus, Art. 27(4) of the AI Act lets a deployer cross-reference or include relevant DPIA sections in its fundamental rights impact assessment. Where the DPIA already meets a FRIA obligation, it need not be repeated. The FRIA's other elements, such as affected groups, oversight and complaints, must still be covered.
Which has higher fines, the GDPR or the EU AI Act?
The AI Act's top tier is higher: €35 million or 7% of worldwide annual turnover for prohibited practices. The GDPR's top tier is €20 million or 4%. The AI Act's tier for most other duties is €15 million or 3%. Both regimes use whichever amount is higher for large firms. The AI Act uses the lower amount for SMEs.
Does the EU AI Act apply if no personal data is used?
Yes. The AI Act applies to AI systems based on their risk tier, whatever data they use. An AI safety component in a machine, or a system that scores anonymized test results, can be regulated even with no personal data. The GDPR, by contrast, applies only when personal data is processed.
Related
Sources
- GDPR, Regulation (EU) 2016/679: Arts. 2, 3, 22, 35, 83 and 99 (EUR-Lex)
- EU AI Act, Regulation (EU) 2024/1689: Arts. 2, 26, 27, 43, 50, 86 and 99 (EUR-Lex)
- Digital Omnibus on AI, Regulation (EU) 2026/1744: Art. 1(2) amending Art. 2(7), Art. 1(6) inserting Art. 4a, Art. 1(13) amending Art. 27 (EUR-Lex)
- AI Act Service Desk: Article 2, scope (consolidated text as amended)