This page helps separate GDPR duties from AI Act work when an AI product or model uses personal data.
Use both tests when an processes personal data. The AI Act classifies the system and assigns duties to AI operators; GDPR governs the lawfulness and handling of the personal data.
An can fall under the EU AI Act, the GDPR, both, or neither. Apply the AI Act to the system, its operator role, and its risk category. Apply the GDPR whenever the design, training, validation, deployment, monitoring, or output handling processes personal data. Passing one assessment does not satisfy the other.
Side-by-side comparison
GDPR vs EU AI Act: two tests for one AI system
Use these rows to separate privacy duties from AI-system duties and identify which evidence can support both reviews.
This side helps assign cited privacy work: lawful basis, transparency, rights, DPIA, Article 22, controller and processor duties, RoPA, security, breach, transfers, and accountability.
Second framework
EU AI Act
This side maps the AI Act's system scope, operator roles, risk-based duties, evidence, phased dates, and enforcement route from Regulation (EU) 2024/1689.
Primary GDPR source for the privacy obligations compared on this page.
processing of personal data
The AI Act governs the placing on the market, putting into service, and use of AI systems in the Union. It also reaches specified providers and deployers outside the Union when system output is used in the Union, subject to its exclusions and special scope rules.
GDPR work belongs to the controller or processor role for the AI processing activity, with input from product, privacy, legal, security, procurement, support, and the DPO where designated.
Supports involving process owners rather than leaving RoPA maintenance only to the DPO.
process owners
AI Act duties attach to roles such as provider, deployer, importer, distributor, product manufacturer, and authorised representative. A provider develops or has a system developed and places it on the market or puts it into service under its name or trademark; a deployer uses a system under its authority outside personal non-professional activity.
Article 3 defines provider, deployer, importer, distributor, and operator roles.
Record both role maps. A company may be a deployer under the AI Act and a controller under GDPR, or a provider under the AI Act and a processor for a customer's personal data.
GDPR is triggered when the AI workflow processes personal data within GDPR scope, including collection, storage, use, disclosure, profiling, retention, transfer, or deletion.
AI Act duties depend on the system and use: prohibited practices under Article 5, high-risk classification under Article 6 and Annexes I and III, transparency duties under Article 50, or rules for general-purpose AI models under Chapter V.
Each AI processing purpose needs an Article 6 lawful basis, privacy information, rights handling, Article 22 analysis where relevant, DPIA screening or DPIA, RoPA coverage, processor controls, security measures, retention, and transfer safeguards where applicable.
Maps Article 6 legal bases and explains why controllers must identify the justification for processing.
consent; contract; legal obligation
High-risk AI providers face requirements for risk management, data and data governance, technical documentation, logs, transparency to deployers, human oversight, accuracy, robustness, cybersecurity, quality management, conformity assessment, registration, and post-market monitoring. Deployers have separate instructions, oversight, monitoring, logging, and other duties. Other systems may have narrower transparency or model-provider duties.
Chapters III, IV, and V establish duties for high-risk systems, certain transparency cases, and general-purpose AI models.
Build the AI Act obligation list from the role and category. Keep the GDPR lawful-basis, notice, rights, DPIA, processor, security, retention, and transfer record alongside it.
GDPR evidence should include a lawful-basis note, privacy notice text, RoPA entry, DPIA or DPIA screening, Article 22 assessment where relevant, rights workflow, processor terms, security control record, transfer safeguard, retention rule, and breach triage record.
AI Act evidence can include classification rationale, quality and risk-management records, data-governance decisions, technical documentation, automatically generated logs, instructions for use, human-oversight design, conformity records, registration, post-market monitoring, and serious-incident records, depending on role and category.
Articles 9 to 15, 17 to 27, 43, 49, 72, and 73 establish evidence and lifecycle duties for relevant high-risk systems and operators.
Reuse inventories, security records, vendor files, and logs only where they contain the information required by both regimes. A GDPR DPIA is not automatically an AI Act conformity assessment or fundamental-rights impact assessment.
GDPR timing is tied to the processing lifecycle: lawful basis and notice before processing, DPIA before high-risk processing, Article 22 and rights handling before automated decisions affect people, breach assessment without undue delay and where feasible within 72 hours for notifiable breaches, and RoPA updates when the processing changes.
Supports DPIA use where processing is likely to result in high risk.
Privacy Impact Assessment
The AI Act entered into force on 1 August 2024. Definitions, the original prohibitions, and AI-literacy duties applied from 2 February 2025; specified governance, penalties, and GPAI duties applied from 2 August 2025; and Article 50 applies from 2 August 2026. Regulation (EU) 2026/1744 entered into force on 27 July 2026, made its added Article 5 provisions applicable from 2 December 2026, and amended Article 113 so that Chapter III, Sections 1, 2, and 3, except Article 6(5), apply from 2 December 2027 for Article 6(2) and Annex III high-risk systems and from 2 August 2028 for Article 6(1) and Annex I high-risk systems.
Articles 111, 113, and 114 establish the original entry into force, transitional treatment, and phased application, as later amended by Regulation (EU) 2026/1744.
Confirms that Article 50 transparency obligations apply from 2 August 2026.
start to apply on 2 August 2026
Calendar GDPR controls around the processing lifecycle. For each AI Act obligation, record the applicable article, transition rule, source date, current legal status, and any amending act.
GDPR supervisory authorities can impose Article 58 corrective measures and Article 83 fines. The lower ceiling is EUR 10 million or 2 percent of worldwide annual turnover for an undertaking, whichever is higher; the upper ceiling is EUR 20 million or 4 percent, whichever is higher. The amount remains case-specific and requires an intentional or negligent infringement.
Supports supervisory authority powers, corrective measures, administrative fines, and controller or processor accountability.
administrative fine
The AI Act uses national competent and market-surveillance authorities, while the Commission and AI Office enforce GPAI-provider duties. Article 99 ceilings include EUR 35 million or 7 percent for prohibited-practice infringements, EUR 15 million or 3 percent for specified other infringements, and EUR 7.5 million or 1 percent for incorrect, incomplete, or misleading information, with special undertaking and SME rules. Article 101 allows GPAI-provider fines up to 3 percent of total worldwide annual turnover in the preceding financial year.
Chapters VII, IX, and XII establish governance, post-market enforcement, complaints, and penalties.
Open separate regulator and sanctions tracks. Identify the exact infringement, authority, legal ceiling, undertaking rule, and applicable transition date under each regime; the same conduct can engage both without one fine automatically displacing the other.
GDPR evidence can overlap with AI governance records when the same inventory, vendor file, security control, log, or transfer record describes personal-data processing.
Supports SCC evidence for international transfer safeguards.
Standard Contractual Clauses
AI Act records can reuse factual material from GDPR inventories, DPIAs, vendor reviews, security controls, and logs when the material also meets the relevant AI Act content and retention rule.
Supports AI Act documentation, logging, risk-management, and fundamental-rights impact assessment duties where applicable.
Article 2(7) preserves EU privacy and data-protection law, and Article 27(4) says an AI Act fundamental-rights impact assessment complements a GDPR DPIA where both are required. Reuse verified facts, but preserve each assessment's trigger, content, owner, outcome, authority route, and update rule.
For every operation involving personal data, issue a GDPR processing finding that names the controller and processor, purpose, Article 6 basis, Article 9 condition where needed, notice, rights and Article 22 result, DPIA result, RoPA entry, retention, security, processors, transfers, and launch conditions.
Primary source for GDPR duties used in the decision rule.
responsibility of the controller
For every candidate AI function, issue an AI Act classification finding that applies the Article 3 AI-system definition, maps provider and deployer roles, tests Article 5 prohibitions, applies Article 6 and the relevant annex, tests Article 50 and GPAI duties, and records the controlling application date and transition rule.
Primary source for the AI Act classification and role decision.
The approval record contains two conclusions and two owners. Link shared facts and evidence by identifier, list unresolved assumptions, and block launch when either finding has an unmet legal condition; do not merge the conclusions into a generic 'AI compliant' status.
Primary GDPR source for the privacy obligations compared on this page.
processing of personal data
EU AI Act
The AI Act governs the placing on the market, putting into service, and use of AI systems in the Union. It also reaches specified providers and deployers outside the Union when system output is used in the Union, subject to its exclusions and special scope rules.
Article 2(7) preserves the application of EU personal-data, privacy, and communications-confidentiality law.
Who must act
GDPR
GDPR work belongs to the controller or processor role for the AI processing activity, with input from product, privacy, legal, security, procurement, support, and the DPO where designated.
Supports involving process owners rather than leaving RoPA maintenance only to the DPO.
process owners
EU AI Act
AI Act duties attach to roles such as provider, deployer, importer, distributor, product manufacturer, and authorised representative. A provider develops or has a system developed and places it on the market or puts it into service under its name or trademark; a deployer uses a system under its authority outside personal non-professional activity.
Article 3 defines provider, deployer, importer, distributor, and operator roles.
Operational implication
Record both role maps. A company may be a deployer under the AI Act and a controller under GDPR, or a provider under the AI Act and a processor for a customer's personal data.
Article 3 role definitions show why AI Act and GDPR role labels must be assigned separately.
Trigger
GDPR
GDPR is triggered when the AI workflow processes personal data within GDPR scope, including collection, storage, use, disclosure, profiling, retention, transfer, or deletion.
AI Act duties depend on the system and use: prohibited practices under Article 5, high-risk classification under Article 6 and Annexes I and III, transparency duties under Article 50, or rules for general-purpose AI models under Chapter V.
Supports asking the controller's reason or justification before processing personal data.
legal basis
Core obligations
GDPR
Each AI processing purpose needs an Article 6 lawful basis, privacy information, rights handling, Article 22 analysis where relevant, DPIA screening or DPIA, RoPA coverage, processor controls, security measures, retention, and transfer safeguards where applicable.
Maps Article 6 legal bases and explains why controllers must identify the justification for processing.
consent; contract; legal obligation
EU AI Act
High-risk AI providers face requirements for risk management, data and data governance, technical documentation, logs, transparency to deployers, human oversight, accuracy, robustness, cybersecurity, quality management, conformity assessment, registration, and post-market monitoring. Deployers have separate instructions, oversight, monitoring, logging, and other duties. Other systems may have narrower transparency or model-provider duties.
Chapters III, IV, and V establish duties for high-risk systems, certain transparency cases, and general-purpose AI models.
Operational implication
Build the AI Act obligation list from the role and category. Keep the GDPR lawful-basis, notice, rights, DPIA, processor, security, retention, and transfer record alongside it.
Article 6 and transparency provisions require a GDPR basis and related information.
Processing shall be lawful
Evidence and records
GDPR
GDPR evidence should include a lawful-basis note, privacy notice text, RoPA entry, DPIA or DPIA screening, Article 22 assessment where relevant, rights workflow, processor terms, security control record, transfer safeguard, retention rule, and breach triage record.
AI Act evidence can include classification rationale, quality and risk-management records, data-governance decisions, technical documentation, automatically generated logs, instructions for use, human-oversight design, conformity records, registration, post-market monitoring, and serious-incident records, depending on role and category.
Articles 9 to 15, 17 to 27, 43, 49, 72, and 73 establish evidence and lifecycle duties for relevant high-risk systems and operators.
Operational implication
Reuse inventories, security records, vendor files, and logs only where they contain the information required by both regimes. A GDPR DPIA is not automatically an AI Act conformity assessment or fundamental-rights impact assessment.
Supports keeping GDPR evidence independent from AI Act work.
accountability
Timing and cadence
GDPR
GDPR timing is tied to the processing lifecycle: lawful basis and notice before processing, DPIA before high-risk processing, Article 22 and rights handling before automated decisions affect people, breach assessment without undue delay and where feasible within 72 hours for notifiable breaches, and RoPA updates when the processing changes.
Supports DPIA use where processing is likely to result in high risk.
Privacy Impact Assessment
EU AI Act
The AI Act entered into force on 1 August 2024. Definitions, the original prohibitions, and AI-literacy duties applied from 2 February 2025; specified governance, penalties, and GPAI duties applied from 2 August 2025; and Article 50 applies from 2 August 2026. Regulation (EU) 2026/1744 entered into force on 27 July 2026, made its added Article 5 provisions applicable from 2 December 2026, and amended Article 113 so that Chapter III, Sections 1, 2, and 3, except Article 6(5), apply from 2 December 2027 for Article 6(2) and Annex III high-risk systems and from 2 August 2028 for Article 6(1) and Annex I high-risk systems.
Articles 111, 113, and 114 establish the original entry into force, transitional treatment, and phased application, as later amended by Regulation (EU) 2026/1744.
Confirms that Article 50 transparency obligations apply from 2 August 2026.
start to apply on 2 August 2026
Operational implication
Calendar GDPR controls around the processing lifecycle. For each AI Act obligation, record the applicable article, transition rule, source date, current legal status, and any amending act.
Supports carrying out a DPIA before high-risk processing is deployed.
demonstrate compliance
Enforcement or assurance route
GDPR
GDPR supervisory authorities can impose Article 58 corrective measures and Article 83 fines. The lower ceiling is EUR 10 million or 2 percent of worldwide annual turnover for an undertaking, whichever is higher; the upper ceiling is EUR 20 million or 4 percent, whichever is higher. The amount remains case-specific and requires an intentional or negligent infringement.
Supports supervisory authority powers, corrective measures, administrative fines, and controller or processor accountability.
administrative fine
EU AI Act
The AI Act uses national competent and market-surveillance authorities, while the Commission and AI Office enforce GPAI-provider duties. Article 99 ceilings include EUR 35 million or 7 percent for prohibited-practice infringements, EUR 15 million or 3 percent for specified other infringements, and EUR 7.5 million or 1 percent for incorrect, incomplete, or misleading information, with special undertaking and SME rules. Article 101 allows GPAI-provider fines up to 3 percent of total worldwide annual turnover in the preceding financial year.
Chapters VII, IX, and XII establish governance, post-market enforcement, complaints, and penalties.
Operational implication
Open separate regulator and sanctions tracks. Identify the exact infringement, authority, legal ceiling, undertaking rule, and applicable transition date under each regime; the same conduct can engage both without one fine automatically displacing the other.
Supports making Article 30 evidence available for supervisory review.
prescribed information
Overlap and reuse
GDPR
GDPR evidence can overlap with AI governance records when the same inventory, vendor file, security control, log, or transfer record describes personal-data processing.
Supports SCC evidence for international transfer safeguards.
Standard Contractual Clauses
EU AI Act
AI Act records can reuse factual material from GDPR inventories, DPIAs, vendor reviews, security controls, and logs when the material also meets the relevant AI Act content and retention rule.
Supports AI Act documentation, logging, risk-management, and fundamental-rights impact assessment duties where applicable.
Operational implication
Article 2(7) preserves EU privacy and data-protection law, and Article 27(4) says an AI Act fundamental-rights impact assessment complements a GDPR DPIA where both are required. Reuse verified facts, but preserve each assessment's trigger, content, owner, outcome, authority route, and update rule.
Supports treating transfer safeguards as a GDPR evidence requirement for AI vendors handling personal data.
international data transfers
Practical decision rule
GDPR
For every operation involving personal data, issue a GDPR processing finding that names the controller and processor, purpose, Article 6 basis, Article 9 condition where needed, notice, rights and Article 22 result, DPIA result, RoPA entry, retention, security, processors, transfers, and launch conditions.
Primary source for GDPR duties used in the decision rule.
responsibility of the controller
EU AI Act
For every candidate AI function, issue an AI Act classification finding that applies the Article 3 AI-system definition, maps provider and deployer roles, tests Article 5 prohibitions, applies Article 6 and the relevant annex, tests Article 50 and GPAI duties, and records the controlling application date and transition rule.
Primary source for the AI Act classification and role decision.
Operational implication
The approval record contains two conclusions and two owners. Link shared facts and evidence by identifier, list unresolved assumptions, and block launch when either finding has an unmet legal condition; do not merge the conclusions into a generic 'AI compliant' status.
Supports the separate AI Act finding and the preservation of GDPR duties.
Practical decision rule
How should teams compare GDPR and the EU AI Act for an AI system?
First decide whether the AI use case processes personal data and record the GDPR controller or processor role.
Assign the GDPR controls that are cited here: lawful basis, transparency, rights, DPIA or screening, Article 22, RoPA, security, breach, transfer, retention, and accountability evidence.
Classify the AI Act role and branch: prohibited practice, high-risk system, transparency case, general-purpose AI model, or another in-scope system.
Keep shared evidence labelled by source so privacy and AI Act reviewers can each re-run the decision.
Primary source for the AI Act role, classification, evidence, and timing path.
1
Section 1
Run two legal tests on the same AI use case
The AI Act applies to providers placing AI systems or general-purpose AI models on the Union market, deployers established or located in the Union, and certain providers or deployers outside the Union when an 's output is used in the Union. It distinguishes providers, deployers, importers, distributors, product manufacturers, and other operators. Duties then depend on whether the practice is prohibited, the system is high-risk, a transparency rule applies, or a general-purpose AI model is involved.
The GDPR applies in parallel when the AI lifecycle processes personal data. Article 2(7) of the AI Act expressly preserves EU data-protection and communications-privacy law, subject to two specified AI Act provisions. Providers and deployers can therefore be AI Act operators and GDPR controllers or processors at the same time, but the labels are not interchangeable.
Map the AI Act role from who develops, brands, places on the market, puts into service, imports, distributes, or uses the system.
Map the GDPR role from who determines the purposes and means of personal-data processing and who processes on instructions.
Classify the under the AI Act, then run GDPR lawful-basis, transparency, rights, DPIA, security, processor, retention, and transfer checks on every personal-data operation.
Keep one system inventory if useful, but give each conclusion its own legal source, owner, evidence, and review date.
Primary AI Act text for scope, operator definitions, prohibited practices, high-risk systems, transparency, general-purpose AI models, governance, enforcement, and phased application.
2
Section 2
GDPR questions to answer before an AI Act workstream
For any AI-enabled processing, start with the GDPR questions that determine whether privacy controls are required at all. The first record should identify the controller or processor, the purpose, categories of data subjects and personal data, recipients, transfers, retention, security controls, and whether the processing is likely to create risk for individuals.
Then document the Article 6 lawful basis before launch. Irish DPC guidance frames the first controller question as the reason or justification for processing personal data, and lists the Article 6 legal bases as consent, contract, legal obligation, vital interests, public task, or legitimate interests.
Record the Article 6 lawful basis for each AI processing purpose, not for the product as a whole.
Update the RoPA when the AI workflow changes the purpose, data categories, recipients, transfers, retention, or security measures.
Record the separate AI Act role, risk category, applicable chapter, and implementation date beside the GDPR processing record.
Supports keeping granular records of processing activities, including purposes, data categories, recipients, transfers, erasure time limits, and security measures.
Record of Processing Activities
3
Section 3
Transparency, rights, DPIA, and automated decision-making controls
AI use does not supersede GDPR transparency duties. GDPR Articles 13 and 14 require information about the purposes and legal basis, recipients, storage periods, rights, and the existence of automated decision-making including profiling where relevant. Article 15 also gives the data subject access rights that include information about automated decision-making in the stated cases.
Article 22 adds a separate GDPR control for decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects. When an contributes to such a decision, the GDPR review should document the decision path, human involvement, legal basis, safeguards, rights handling, and the notice language.
A DPIA is required where processing is likely to result in a high risk to natural persons. CNIL's DPIA page and methodology support using the assessment to examine necessity, proportionality, rights controls, processors, transfers, and security risks before the processing is deployed.
Do not use an AI Act label as a substitute for GDPR notice, access, objection, rectification, erasure, restriction, portability, or Article 22 analysis.
When relying on legitimate interests for AI-enabled processing, keep the balancing analysis and make the specific interest clear in the privacy information.
Where a DPIA is needed, include purpose, data minimisation, retention, information notices, rights handling, processor controls, transfer safeguards, and security measures.
Explains that a DPIA is required where processing is likely to result in high risk and links methodology and templates for demonstrating compliance.
Data Protection Impact Assessment
4
Section 4
Evidence owners for a GDPR-first AI comparison
Assign the GDPR evidence to teams that can change the underlying processing: product for purpose and feature behavior, data governance for data categories and retention, legal or privacy for lawful basis and notices, security for Article 32 controls, procurement for processor and transfer terms, support for rights workflows, and the DPO where designated for DPIA advice and monitoring.
AI Act evidence commonly belongs to product, engineering, quality, risk, procurement, and legal teams, depending on the operator role and classification. A shared owner can manage both workstreams, but each record should identify whether it proves a GDPR obligation, an AI Act obligation, or only a shared fact.
Required GDPR evidence commonly includes a RoPA entry, lawful-basis note, privacy notice text, DPIA or DPIA screening, Article 22 assessment where relevant, rights-response workflow, processor terms, transfer safeguards, retention rule, security control record, and breach triage record.
Label source support beside each artifact so reviewers can see whether it comes from GDPR text, DPC guidance, CNIL DPIA material, SCC material, or a separate AI Act source.
Do not merge GDPR and AI Act findings into one approval unless the record shows both source bases and both owners.
Supports using SCC materials when AI processing involves personal-data transfers to third countries or international organisations.
Standard Contractual Clauses
5
Section 5
Current AI Act dates and guidance as of 27 July 2026
The AI Act applies in phases. Chapters I and II, including definitions, AI literacy, and the original prohibited practices, have applied since 2 February 2025. Regulation (EU) 2026/1744 added Article 5 provisions that apply from 2 December 2026. Governance provisions, penalties, and general-purpose AI model obligations have applied since 2 August 2025, subject to the regulation's transition rules. Article 50 transparency duties apply from 2 August 2026, and the Commission published final Article 50 guidelines on 20 July 2026.
Regulation (EU) 2026/1744 entered into force on 27 July 2026 and amended the AI Act's transition rules. Chapter III, Sections 1, 2, and 3, except Article 6(5), apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III and from 2 August 2028 for systems classified as high-risk under Article 6(1) and Annex I.
2 February 2025: Chapters I and II apply, including Article 4 AI literacy and the original Article 5 prohibited practices; the Article 5 provisions added by Regulation (EU) 2026/1744 apply from 2 December 2026.
2 August 2025: the published regulation applies specified governance, GPAI, penalty, and confidentiality provisions; transition rules still matter for models already on the market.
2 August 2026: Article 50 transparency duties apply, and Commission enforcement powers for GPAI providers begin under the published framework.
High-risk systems: record the applicable Article 6 route and the binding date in Article 113 as amended by Regulation (EU) 2026/1744.
Legacy systems: Article 111 has separate rules for systems and GPAI models already on the market or in service; do not apply a new-system date without checking those transition provisions.
Final Commission guidelines published 20 July 2026 for Article 50 obligations applying from 2 August 2026.
start to apply on 2 August 2026
6
Section 6
Worked GDPR and AI Act classification cases
Run the tests at feature and processing-operation level. The examples below identify the questions and records that change the result; they do not decide whether an unnamed product complies.
For each case, produce two signed or approved findings: a GDPR processing finding naming the role, purpose, lawful basis, personal data, rights, risk controls, and evidence; and an AI Act finding naming the system, operator role, classification branch, applicable date, obligations, and evidence.
Recruitment ranking: an employer using AI to filter or rank candidates processes personal data as a controller and should assess lawful basis, notice, a DPIA, bias and accuracy risks, rights, retention, security, and whether Article 22 applies to the actual decision path. Employment selection is an Annex III high-risk area unless an Article 6 exclusion applies; profiling covered by the Annex III use case remains high-risk. The employer is normally the deployer, while the vendor may be the provider and a GDPR processor or separate controller depending on its own purposes.
Customer-service chatbot: prompts, account context, transcripts, and escalations can bring the workflow within GDPR even when the chatbot is not high-risk under Article 6. Map notice, lawful basis, processor terms, retention, security, transfers, rights, and breach handling. Article 50 requires disclosure that a person is interacting with AI unless this is obvious from the circumstances and context, subject to the regulation's stated exception.
Workplace emotion inference: Article 5 prohibits using AI to infer emotions in workplaces and educational institutions except for medical or safety reasons. A claimed exception needs a documented intended purpose and facts. Personal-data and, where applicable, special-category or biometric-data analysis remains separate under GDPR; passing a GDPR lawful-basis test cannot legalise an AI Act prohibited practice.
Public-service high-risk deployment: a public-law body, or a private operator providing public services, that deploys an Annex III high-risk system may need an Article 27 fundamental-rights impact assessment. If the processing also triggers GDPR Article 35, coordinate the evidence but retain a complete DPIA and a complete Article 27 assessment, including the distinct notification and oversight steps.
General-purpose model API: distinguish the GPAI model provider from the provider or deployer of a downstream . Then map whether prompts, fine-tuning data, retrieval data, logs, outputs, or abuse monitoring contain personal data and whether each actor is a controller or processor. GPAI compliance does not supply the downstream system's GDPR lawful basis or AI Act classification.
Current Commission guidance for provider and deployer transparency duties applying from 2 August 2026.
7
Section 7
Definitions used in this GDPR and AI Act comparison
: a machine-based system that operates with varying autonomy, may adapt after deployment, and infers from inputs how to generate outputs that can influence physical or virtual environments. Test the statutory elements rather than the product's marketing label.
Personal data: information relating to an identified or identifiable person. AI training, prompts, retrieval content, logs, embeddings, outputs, inferences, feedback, and monitoring can contain personal data.
Controller and processor: the controller determines why and how personal data is processed; the processor acts on the controller's behalf under documented instructions. Assign these roles per processing operation, including any vendor use for its own purposes.
Provider and deployer: an AI Act provider develops or has an or GPAI model developed and markets it or puts the system into service under its name; a deployer uses an AI system under its authority outside personal non-professional activity. These roles can coexist with GDPR roles.
High-risk : a system classified under Article 6 through the Annex I product route or an Annex III use case, subject to Article 6(3). Record the exact route, intended purpose, exclusion analysis, and profiling question.
DPIA: the GDPR Article 35 assessment completed before likely high-risk personal-data processing. It addresses necessity, proportionality, risks to people, and measures.
Fundamental-rights impact assessment: the AI Act Article 27 assessment required for specified deployers and Annex III high-risk systems. It complements rather than replaces a required DPIA.
Articles 3, 6, 25, and 27 support the AI system, provider, deployer, high-risk-system, and fundamental-rights-impact-assessment definitions.
Recommended next step
Turn the GDPR side of an AI review into cited implementation work
Sorena can help turn AI-related GDPR questions into lawful-basis records, notices, DPIA checks, Article 22 analysis, RoPA updates, rights workflows, processor controls, and transfer evidence.
Primary AI Act text for system scope, operator roles, risk categories, duties, evidence, enforcement, and application dates.
Primary AI Act text for scope, operator definitions, prohibited practices, high-risk systems, transparency, general-purpose AI models, governance, enforcement, and phased application.
Articles 111 and 113 provide the original transition and application dates, as later amended by Regulation (EU) 2026/1744.
Show 15 more
Articles 3, 5, 6, 25, 27, 50, 51 to 55, and Annex III support the AI system, operator, prohibition, high-risk, FRIA, transparency, and GPAI questions.
Articles 3, 6, 25, and 27 support the AI system, provider, deployer, high-risk-system, and fundamental-rights-impact-assessment definitions.
Articles 1 and 2 establish the AI Act subject matter and scope.
Article 2(7) preserves the application of EU personal-data, privacy, and communications-confidentiality law.
Article 3 defines provider, deployer, importer, distributor, and operator roles.
Article 3 role definitions show why AI Act and GDPR role labels must be assigned separately.
Articles 5, 6, and 50 and Chapter V establish the main AI Act classification branches.
Chapters III, IV, and V establish duties for high-risk systems, certain transparency cases, and general-purpose AI models.
Articles 9 to 15, 17 to 27, 43, 49, 72, and 73 establish evidence and lifecycle duties for relevant high-risk systems and operators.
Articles 111, 113, and 114 establish the original entry into force, transitional treatment, and phased application, as later amended by Regulation (EU) 2026/1744.
Chapters VII, IX, and XII establish governance, post-market enforcement, complaints, and penalties.
Supports AI Act documentation, logging, risk-management, and fundamental-rights impact assessment duties where applicable.
Primary source for the AI Act classification and role decision.
Supports the separate AI Act finding and the preservation of GDPR duties.
Primary source for the AI Act role, classification, evidence, and timing path.
Supports granular records of processing activities and process-owner accountability.
Supports keeping granular records of processing activities, including purposes, data categories, recipients, transfers, erasure time limits, and security measures.
Supports process-owner involvement, granular RoPA content, and keeping prescribed Article 30 information visible.
Show 2 more
Supports involving process owners rather than leaving RoPA maintenance only to the DPO.
Supports making Article 30 evidence available for supervisory review.