EU AI Act · GDPR
The EU AI Act and GDPR are not separate problems. Wherever an AI system touches personal data or makes decisions about people, both apply at once. Here is where they overlap — and how to satisfy both with a single set of controls.
Where they meet
EU AI Act
Art. 26(3) — deployers must ensure input data is relevant and representative.
GDPR
Lawful basis, purpose limitation, and accuracy for any personal data used or fed to the system.
The control that satisfies both: Document the data lineage: where input data comes from, its lawful basis, and how accuracy is maintained.
EU AI Act
High-risk systems that profile or make decisions about people trigger AI Act duties.
GDPR
Article 22 — right not to be subject to a decision based solely on automated processing, with exceptions.
The control that satisfies both: Where the system makes a decision about a person, add a human review step and a right to contest it.
EU AI Act
Art. 26(4) — retain execution logs for at least six months.
GDPR
Accountability (Art. 5(2)) — you must be able to demonstrate processing compliance.
The control that satisfies both: One audit trail that satisfies both: structured logs of what the system did, when, on whose data, and with which human decision.
EU AI Act
High-risk deployers must assess fundamental-rights impact (Art. 26(6)).
GDPR
DPIA required for large-scale or high-risk processing of personal data (Art. 35).
The control that satisfies both: Run a single combined assessment covering both regimes — same facts, both checklists, one evidence bundle.
EU AI Act
You may still be a deployer of AI features inside a SaaS tool you do not own.
GDPR
You remain the controller; the SaaS vendor is a processor (or a separate controller) — the relationship must be documented.
The control that satisfies both: A vendor inventory that names the AI features, the role of each party, and the contract that binds them.
The mistake most companies make is treating AI Act compliance and GDPR compliance as two separate workstreams, with two sets of documents, and discovering the gaps in both only when a regulator asks. The controls overlap heavily — data lineage, human oversight, logging, impact assessment, vendor documentation. A single, well-built evidence bundle satisfies both.
The €500 readiness audit maps your AI Act and GDPR obligations together and gives you a 90-day roadmap with one evidence bundle. Ten business days. You keep the documentation.
FAQ
Yes. Wherever an AI system touches personal data or makes decisions about people, both regimes apply at once. They are separate legal instruments with different rules, but they frequently point at the same facts — training data, automated decisions, logging, impact assessment, and the vendor chain.
No. The controls overlap heavily: data lineage, human oversight, structured logging, impact assessment, and vendor documentation. A single, well-built evidence bundle can satisfy both — the mistake is maintaining two separate document piles and discovering the gaps in both only when a regulator asks.
Under GDPR, Article 22 gives a right not to be subject to a decision based solely on automated processing, with exceptions. Under the AI Act, high-risk systems that profile or decide about people trigger AI Act duties. Where the system decides about a person, add a human review step and a right to contest it — that satisfies both.
Run a single combined assessment covering both regimes — the same facts against both checklists, producing one evidence bundle. GDPR requires a DPIA for large-scale or high-risk processing (Article 35); the AI Act requires a fundamental-rights impact assessment for high-risk deployers (Article 26(6)).