EU AI Act vs. GDPR: How AI Regulation Changes Data Privacy in 2026

Data Privacy & AI · 10 min read · Updated March 2026

The EU AI Act does not replace GDPR — it sits alongside it, creating an entirely new layer of obligations that interact with, overlap, and in some places conflict with data protection law. For organisations already navigating GDPR compliance, understanding where the two frameworks diverge is critical for avoiding double exposure.

Key Takeaways

GDPR governs what data you can collect and process. The EU AI Act governs how AI systems behave. Both can apply to the same system simultaneously.
An AI system processing personal data can trigger 2–3 separate compliance assessments: DPIA (GDPR), FRIA (EU AI Act), and a full conformity assessment (EU AI Act).
The EU AI Act’s highest fines (7% of global turnover) exceed GDPR’s maximum (4%), making it the more severe regime for prohibited practices.
Several new EU AI Act obligations — AI literacy, human oversight, and post-market monitoring — have no GDPR equivalent and require entirely new compliance infrastructure.

The Core Difference: What Each Law Actually Regulates

The most important starting point is understanding that GDPR and the EU AI Act regulate different things, even when they apply to the same system.

🔒

GDPR (2018)

Regulates: The processing of personal data — collection, storage, use, transfer, and deletion.

Core question: Do you have a lawful basis to process this personal data? Is the data subject’s rights protected?

Key tools: Privacy notices, DPIAs, data subject rights, DPO appointment, breach notification within 72 hours.

🤖

EU AI Act (2024)

Regulates: The design, development, and deployment of AI systems — their safety, accuracy, transparency, and human oversight.

Core question: Is this AI system safe, accurate, and transparent? Can humans understand and override it?

Key tools: Risk management systems, technical documentation, conformity assessment, EU database registration, post-market monitoring.

In practice, most AI systems that are high-risk under the EU AI Act will also process personal data — which means GDPR applies too. An HR screening AI, a credit scoring model, or a medical diagnostic system will trigger obligations under both frameworks simultaneously. Your compliance programme must address both.

Reference: European Data Protection Board — Opinion on AI Act and GDPR interaction (2024)

EU AI Act vs. GDPR: Side-by-Side Comparison

Dimension	GDPR	EU AI Act
What it regulates	Personal data processing	AI system design, deployment, and use
Who is regulated	Data controllers and processors	AI providers, deployers, importers, distributors
Territorial scope	Any processing of EU residents’ data	Any AI system placed on EU market or affecting EU users
Risk assessment tool	Data Protection Impact Assessment (DPIA)	Fundamental Rights Impact Assessment (FRIA) + Conformity Assessment
Maximum fine	€20M or 4% of global turnover	€35M or 7% of global turnover (prohibited AI)
Enforcement body	National Data Protection Authorities (DPAs)	EU AI Office + National Market Surveillance Authorities
Individual rights	Access, erasure, portability, objection, automated decision rights	Right to explanation of AI-assisted decisions; complaint to deployer
Consent model	Requires legal basis (consent, legitimate interest, contract, etc.)	No consent mechanism — compliance is technical and procedural
Applies without personal data?	No — GDPR only applies to personal data	Yes — EU AI Act applies regardless of whether personal data is involved

Where GDPR and the EU AI Act Overlap — and Where They Conflict

Overlapping Areas

Automated Decision-Making

GDPR Article 22 gives individuals the right not to be subject to solely automated decisions that produce legal or significant effects, and the right to obtain human intervention and explanation. The EU AI Act Article 14 requires high-risk AI systems to be designed with human oversight capabilities, and Article 26 requires deployers to implement a right to explanation. These two sets of obligations are complementary — both require human review mechanisms — but they apply on different bases and to different actors. Organisations must satisfy both.

Special Category Data in AI Training

Under GDPR, processing special category data (health, racial origin, political opinions, biometric data, etc.) requires explicit consent or one of the Article 9(2) exceptions. Under the EU AI Act Article 10(5), special category data may only be used in AI training where strictly necessary to detect and correct bias. Both conditions must be met: the GDPR legal basis and the AI Act necessity test. Many organisations training models on historical HR data or healthcare records face this dual compliance challenge.

Impact Assessments

A GDPR Data Protection Impact Assessment (DPIA) and an EU AI Act Fundamental Rights Impact Assessment (FRIA) have significant overlapping scope when applied to the same AI system. The European Data Protection Board (EDPB) has issued guidance recommending that organisations integrate their DPIA and FRIA processes where possible, rather than running two entirely separate exercises. Practically, this means extending your existing DPIA template to cover fundamental rights impacts beyond privacy.

Potential Tensions

Data Minimisation vs. AI Documentation Requirements

GDPR’s data minimisation principle requires retaining personal data only as long as necessary for its original purpose. The EU AI Act requires providers to retain all technical documentation — including training data records and accuracy testing results — for 10 years after market placement (Article 18). Where training data includes personal data, organisations must reconcile the 10-year documentation retention requirement with GDPR’s storage limitation principle. Solution: anonymise or pseudonymise training data records where possible while retaining non-personal documentation.

Transparency Conflicts

GDPR Article 22 requires organisations to provide “meaningful information about the logic involved” in automated decisions. The EU AI Act Article 13 requires providers to provide instructions for use, including information about system capabilities and limitations. However, both requirements must be balanced against trade secret protection — neither law requires full algorithmic disclosure. Organisations should develop tiered transparency documentation: detailed technical records for regulators, meaningful explanations for affected individuals.

Dual Enforcement Exposure

GDPR is enforced by National Data Protection Authorities (DPAs). The EU AI Act is enforced by separate National Market Surveillance Authorities (NMSAs) and the EU AI Office. These bodies operate independently — meaning a single AI incident (say, a biased HR screening decision) could trigger simultaneous investigations by both. The EU AI Office has committed to developing coordination protocols with DPAs to avoid duplicative enforcement, but these are not yet fully operational.

Practical Implications: What Changes for Your Compliance Team

Organisations that have invested in GDPR compliance have a meaningful head start — but the EU AI Act introduces several entirely new obligations with no GDPR equivalent:

New EU AI Act Obligation	GDPR Equivalent?	What You Need to Build
AI Literacy Training (Art. 4)	No equivalent	Role-based training programme for all staff working with AI systems
Conformity Assessment (Art. 43)	No equivalent	Systematic technical verification against all Articles 8–15
Human-in-the-Loop Controls (Art. 14)	Partial (Art. 22 GDPR)	Real-time monitoring dashboards, override mechanisms, halt capabilities
Post-Market Monitoring (Art. 72)	No equivalent	Ongoing production performance tracking and KPI reporting system
EU AI Database Registration (Art. 49)	No equivalent	Submission to EU AI Office public registry before market placement
Quality Management System (Art. 17)	Partial (data governance policies)	Documented QMS covering AI design, testing, deployment, and monitoring

💡 Practical recommendation for DPOs

Data Protection Officers are well-positioned to lead or co-lead EU AI Act compliance — their experience with risk assessment methodology, documentation standards, and regulatory engagement is directly transferable. However, most DPOs will need to upskill on AI-specific technical concepts: training data governance, model accuracy metrics, bias testing methodologies, and conformity assessment procedures.

The IAPP EU AI Act Resource Centre and the EU AI Act reference site are good starting points for upskilling resources.

Biometric Data: Where the Overlap is Sharpest

Biometric data sits at the intersection of both frameworks and deserves special attention. Under GDPR, biometric data processed for the purpose of uniquely identifying individuals is a special category requiring explicit consent or another Article 9(2) exception. Under the EU AI Act, AI systems that use biometric data for real-time identification are either prohibited outright or classified as high-risk.

Biometric AI Use Case	GDPR Status	EU AI Act Status
Real-time facial recognition in public	Special category — strict conditions	PROHIBITED (Art. 5)
Post-hoc identification from CCTV	Special category — strict conditions	HIGH RISK (Annex III)
Emotion detection in workplace/education	Special category — may require consent	PROHIBITED (Art. 5)
Biometric access control (fingerprint/iris)	Special category — consent or employment law	Likely limited risk or minimal risk
Biometric categorisation by sensitive attributes	Special category — very restricted	PROHIBITED (Art. 5)

If you deploy any AI system using biometric data, you should immediately assess compliance against both frameworks. Use our free risk assessment tool to determine your EU AI Act classification, then cross-reference with your GDPR legal basis documentation.

Your 2026 Action Plan: Integrating GDPR and EU AI Act Compliance

Audit your AI systems against both frameworks simultaneously. For each high-risk AI system, map your GDPR compliance status (legal basis, DPIA status, data subject rights mechanisms) alongside your EU AI Act compliance gaps (technical documentation, conformity assessment, HITL controls).

Extend your DPIA template to incorporate FRIA questions. Add a section covering impacts on fundamental rights beyond privacy: employment rights, access to financial services, freedom from discrimination, and access to justice. This creates a single integrated assessment document.

Align data retention policies with the 10-year documentation requirement. Pseudonymise personal data in technical records where possible while ensuring the AI Act’s documentation requirements are met using non-personal technical data.

Establish joint oversight between your DPO and your AI compliance lead. Create a shared governance forum that reviews AI systems against both frameworks together, rather than managing two separate compliance silos that never communicate.

Start your EU AI Act compliance programme

Our 4-phase checklist covers every high-risk AI obligation from scoping through to EU database registration — with article references and compliance tips for each item.

View Compliance Checklist →

Frequently Asked Questions

Can a single AI incident trigger both GDPR and EU AI Act enforcement? +

Yes. A biased HR screening decision, for example, could simultaneously be a GDPR violation (unlawful automated decision, inadequate transparency) and an EU AI Act violation (failure to ensure bias detection in training data, inadequate human oversight). Each framework is enforced by different authorities: national DPAs for GDPR, national market surveillance authorities and the EU AI Office for the AI Act. Both can investigate the same incident independently and impose separate penalties.

Does the EU AI Act apply to AI systems that don’t process personal data? +

Yes — this is one of the most important differences between the two frameworks. GDPR only applies to personal data processing. The EU AI Act applies to AI systems regardless of whether they process personal data. An AI system that controls energy grid load balancing and processes no personal data whatsoever is still subject to EU AI Act high-risk obligations if it manages critical infrastructure. GDPR would not apply; the EU AI Act would.

Which law takes precedence if GDPR and the EU AI Act conflict? +

The EU AI Act explicitly states it is without prejudice to GDPR — meaning both apply in parallel and neither supersedes the other. Where a genuine conflict exists (e.g. data retention timelines), organisations must find solutions that satisfy both frameworks simultaneously. Regulators are not expected to accept compliance with one law as a defence against violations of the other. The European Data Protection Board and EU AI Office have been mandated to develop joint guidance on conflict resolution, expected in 2026.

Sources: EU AI Act — EUR-Lex · GDPR.eu · EDPB Opinion on AI Act · IAPP AI Act Resource Centre