You are GDPR compliant. Your AI system still has a compliance problem — here is exactly what overlaps, what doesn’t, and what your GDPR programme does and doesn’t buy you.
Every in-house legal team in Europe has spent seven years building GDPR compliance — the lawful bases, the DPIAs, the records of processing. Then someone asks the inevitable question: does that cover us for the EU AI Act? The answer, given clearly rather than diplomatically, is no. GDPR compliance is a necessary input to EU AI Act compliance and, for most AI processing personal data, nowhere near sufficient. The regimes coexist, overlap in places, and diverge in ways requiring coordinated but distinct programmes.
Two different laws, three scenarios
GDPR is a data-rights law: it governs personal data processing, with or without AI. The EU AI Act is an AI-systems law: it governs AI systems classified by risk, with or without personal data — an AI safety component managing water pressure, touching no personal data, is squarely inside the Act and entirely outside the GDPR. The boundary is explicit: Article 2(7) provides that Union data protection law applies to personal data processed in connection with the Act’s rights and obligations, and that the Act does not affect the GDPR. Neither replaces, absorbs or outranks the other where both apply.
That produces three positions to map, per system. GDPR only: personal data in a minimal-risk system — a recommendation engine, a spam filter — full GDPR, and from the Act little beyond the Article 4 AI literacy duty, live since February 2025. EU AI Act only: a high-risk system processing no personal data — full Act architecture, zero GDPR. Both at once: a high-risk system processing personal data — CV screening, creditworthiness, medical diagnostics. This is the commercially common case: nearly every Annex III category runs on personal data, often special-category. The overlap is structural.
The timing asymmetry nobody prices
The practical point most overlap analyses miss: the GDPR is fully live today — the binding constraint on AI processing personal data since 2018, waiting for no EU AI Act date. On the Act’s side, the layers phase in: the literacy duty and prohibitions have applied since February 2025, the Article 50 transparency duties and national enforcement since 2 August 2026 — while the heavy high-risk machinery below (risk management, documentation, conformity assessment, post-market monitoring, the FRIA) applies from 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI in regulated products, under Article 113 as amended. Translation: today’s AI-and-personal-data exposure is mostly GDPR exposure plus live transparency duties — and the 2027 runway is the time to build the Act’s architecture on the GDPR foundations you already have.
Where the two genuinely overlap
Risk-based structure: both regimes scale obligations to risk — but the GDPR assesses risks of processing to individuals, while the Act tiers the systems themselves. Similar shape, different object. Transparency: GDPR Articles 12–14 tell individuals how their data is processed; the Act’s Article 13 requires providers of high-risk systems to design for transparency and supply instructions enabling deployers to interpret outputs, and Article 50 requires AI that interacts with people or generates content to be disclosed and marked. Both demand transparency; neither satisfies the other’s. Data governance: Article 10 of the Act requires training, validation and testing data that is relevant, representative and appropriately error-free, with bias practices documented — distinct from minimisation and purpose limitation but built on the same governance infrastructure. GDPR-mature data governance is a head start, not a finish line. Oversight: GDPR Article 22 gives individuals a right against solely automated significant decisions; the Act’s Article 14 requires high-risk systems to be designed for human oversight regardless of whether anyone invokes a right. Satisfying one is not satisfying the other.
Where GDPR compliance does not reach
Five Act requirements have no GDPR analogue, and no GDPR artefact satisfies any of them: the conformity assessment pathway (Article 43 — CE marking, declaration of conformity, database registration); the lifecycle risk management system of Article 9, which a DPIA does not substitute for; the Annex IV technical documentation of Article 11, which records of processing do not cover; post-market monitoring under Article 72; and the Fundamental Rights Impact Assessment. The FRIA deserves precision, because it looks closest to familiar ground: Article 27 requires certain deployers of high-risk systems — public bodies and public-service providers among them — to assess impacts across the full spectrum of fundamental rights before first use, and Article 27(4) provides that where a DPIA already exists, the FRIA complements it. The DPIA comes first; the FRIA supplements; one document does not discharge both. And the roles differ: the FRIA falls on the deployer, the conformity assessment on the provider — an organisation that is both faces both.
The double exposure
One more consequence of Article 2(7): the regimes do not offset. Conduct prohibited under Article 5 of the Act — exploiting vulnerabilities, biometric categorisation of sensitive traits — will often also breach the GDPR’s rules on special categories, automated decisions or lawfulness. The same conduct can then draw enforcement under both frameworks, from different authorities, with penalties assessed independently. A GDPR fine does not extinguish EU AI Act liability, or the reverse.
What your GDPR programme actually gives you
Stated fairly: a mature GDPR programme is a genuine asset — the demonstrable-on-demand accountability posture is exactly what the Act expects, the DPIA muscle maps onto the FRIA process, and the documentation discipline transfers even where the artefacts differ. GDPR compliance teaches you how to run a regulatory programme. The EU AI Act tells you what a second, different programme must cover. Your GDPR programme is the template — never the substitute. Which obligations from which regime attach to each of your systems starts, as always, with classification traced to the text — and ExecLevel AI builds that record in weeks.
Map what your GDPR programme covers — and what it doesn’t — a free assessment conversation at www.execlevelai.eu
Disclaimer: This article is for general informational purposes only and does not constitute legal or compliance advice. EU AI Act requirements may vary depending on your organisation, AI system, and use case. For advice on EU AI Act compliance, visit www.exclevelai.eu