EUAICheck is an independent self-assessment tool. We are not a law firm and have no link with any official authority.
EUAICheck is an independent self-assessment tool published by Vival Solutions (EI). This content is informational, is not legal advice and may change: always check the official text on EUR-Lex.
EU AI Act and GDPR: two distinct regulations that apply together
Updated 30 September 2026 · Regulation (EU) 2024/1689 and Regulation (EU) 2016/679
The EU AI Act does not replace the GDPR. As soon as an AI system processes personal data, which is the case for most business uses, both texts apply at the same time.
GDPR compliance is not enough for the EU AI Act, and vice versa. The two regulations do not share the same subject, do not require the same documents and do not set the same penalties.
1. Different subjects
- GDPR: protects individuals regarding the processing of their personal data, whatever the technology.
- EU AI Act: regulates AI systems by risk level, whether or not they process personal data.
- An AI system with no personal data (e.g. industrial quality control) can fall under the EU AI Act without falling under the GDPR.
- Data processing without AI falls only under the GDPR.
2. Overlapping requirements
- Transparency: informing individuals (GDPR Articles 13-14; EU AI Act Articles 26 and 50).
- Impact assessments: data protection impact assessment (DPIA, GDPR Article 35) and fundamental rights impact assessment (FRIA, EU AI Act Article 27, for certain deployers). Article 27 provides that the FRIA complements the DPIA where the latter already covers some obligations.
- Automated decisions: right not to be subject to a decision based solely on automated processing and right to human intervention (GDPR Article 22); right to an explanation of a high-risk system's role in a decision (EU AI Act Article 86).
- Documentation: record of processing (GDPR); technical documentation and logs (EU AI Act, for high risk).
3. Comparison table
| GDPR | EU AI Act |
|---|
| Subject | Personal data | AI systems and models |
| Trigger | Processing personal data | Placing on the market, putting into service or using an AI system in the EU |
| Fine ceiling | EUR 20M or 4% of global turnover | EUR 35M or 7% of global turnover (prohibited practices) |
| Key document | Record of processing, DPIA | Technical documentation (Annex IV), FRIA, logs |
| Enforcement in France | CNIL | Market surveillance authorities (scheme being set up) |
4. Who enforces?
For the GDPR, the authority is the CNIL. For the EU AI Act, each Member State designates its market surveillance authorities. The scheme announced by the French Government gives coordination to the DGCCRF and a large share of sensitive uses to the CNIL (employment, education, biometrics…), alongside sector authorities such as the ACPR for banking and insurance. This scheme depends on legislation: check its status. The Commission's AI Office supervises general-purpose AI models.
5. Managing both without duplication
- Extend your record of processing to identify processing that uses AI.
- Carry out the DPIA and, where applicable, the FRIA in a single exercise.
- Add AI information to your existing GDPR privacy notices.
- Have the DPO and the person in charge of AI topics work together.
Where does your AI system stand?
17 questions for a first indicative estimate under the EU AI Act. Free.
Start the pre-assessment