The EU AI Act entered into force in August 2024, with obligations phasing in through 2027. For privacy professionals, this is not just another regulation to monitor — it directly intersects with GDPR in ways that create both overlaps and gaps.
If your organization uses AI systems that process personal data (and most do), you now have two regulatory frameworks to satisfy simultaneously. Getting this right requires understanding where they converge and where they diverge.
Why Privacy Teams Should Care About the AI Act
The AI Act regulates AI systems based on risk categories: unacceptable, high-risk, limited, and minimal. But here is what many compliance teams miss: most high-risk AI systems process personal data, which means GDPR already applies.
The difference is that GDPR focuses on data protection while the AI Act focuses on system behavior. You need both.
Consider a hiring algorithm that screens CVs. Under GDPR, you need a legal basis for processing, a privacy notice, and — if you rely on automated decision-making under Article 22 — meaningful human intervention. Under the AI Act, you additionally need a conformity assessment, technical documentation, human oversight mechanisms, and ongoing monitoring.
Neither framework alone covers the full picture.
The Five Key Overlap Areas
1. Transparency and Explainability
GDPR Article 13-14 requires you to inform data subjects about automated decision-making and its significance. The AI Act goes further: high-risk AI systems must be "sufficiently transparent to enable deployers to interpret the system's output and use it appropriately" (Article 13 AI Act).
Practical implication: Your transparency center needs to cover both what personal data you collect and how AI systems use that data to make decisions.
2. Data Protection Impact Assessments
GDPR Article 35 requires a DPIA when processing is "likely to result in a high risk" to individuals. The AI Act requires a Fundamental Rights Impact Assessment (FRIA) for high-risk AI systems used by public bodies or certain private deployers.
These are not the same assessment, but they share significant overlap. Running them separately wastes effort and risks inconsistencies.
Best practice: Conduct a combined DPIA + FRIA that addresses both frameworks in a single document. This creates a more complete risk picture and reduces compliance burden.
3. Human Oversight
GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing. The AI Act requires human oversight for all high-risk AI systems.
The AI Act's human oversight requirements are more specific: they require the ability to understand the system's capabilities and limitations, to correctly interpret output, and to override or reverse the system's decisions.
What this means: A nominal "human in the loop" who rubber-stamps AI decisions satisfies neither framework. You need genuine, informed human review with the technical ability to intervene.
4. Data Quality
GDPR's data accuracy principle (Article 5(1)(d)) requires personal data to be accurate and kept up to date. The AI Act adds specific data governance requirements for training, validation, and testing datasets (Article 10).
If your AI system is trained on inaccurate personal data, you are potentially violating both frameworks simultaneously.
5. Accountability and Documentation
GDPR's accountability principle requires you to demonstrate compliance. The AI Act requires extensive technical documentation, logging of system operations, and quality management systems.
Opportunity: The evidence you collect for GDPR compliance — processing records, DPIAs, consent records — can partially fulfill AI Act documentation requirements. An evidence vault that captures compliance artifacts systematically serves both purposes.
What Changes for DSAR Processing
Data Subject Access Requests get more complex when AI is involved. Under GDPR, individuals can request access to their personal data. When AI systems process that data, the request potentially covers:
- The personal data used as input to the AI system
- The output or decisions the AI system generated about them
- The logic involved in automated decision-making (GDPR Article 15(1)(h))
- Under the AI Act: information about the AI system's intended purpose and level of accuracy
Your DSAR response process needs to account for these expanded disclosure obligations. The standard 30-day GDPR response deadline applies, but gathering AI-related information often takes longer than traditional data retrieval.
Enforcement: Two Regulators, Compounding Risk
GDPR fines can reach €20 million or 4% of global turnover. The AI Act adds fines up to €35 million or 7% of global turnover for the most serious violations.
Critically, a single incident involving an AI system that processes personal data could trigger enforcement under both frameworks. The GDPR enforcement trends we track show regulators are already flagging AI-related processing in their decisions.
In January 2024, the Italian DPA fined Clearview AI €20 million for GDPR violations related to its facial recognition AI. Under the AI Act, the same system would face additional scrutiny as a high-risk AI system in the biometric identification category.
Practical Steps for Privacy Teams
Short-term (now)
- Inventory your AI systems alongside your data inventory. Map which AI systems process personal data and their risk classification under the AI Act.
- Extend your DPIA process to include AI-specific considerations: training data quality, bias testing, human oversight mechanisms.
- Update transparency notices to cover AI-specific disclosures.
Medium-term (2026-2027)
- Implement combined governance: Create a unified AI + privacy governance framework rather than running parallel compliance programs.
- Train your team: Privacy officers need to understand AI risk assessment. AI engineers need to understand data protection by design.
- Build evidence systematically: Both frameworks require demonstrable compliance. Capture evidence of your AI governance decisions alongside your privacy compliance records.
Long-term
- Monitor enforcement: As AI Act enforcement begins, the intersection with GDPR will become clearer through regulatory decisions and guidance. Track enforcement actions across both frameworks.
The Bottom Line
The AI Act does not replace GDPR — it adds a complementary layer of obligations. Organizations that treat these as separate compliance programs will duplicate effort and miss the intersections where real risk lies.
The most effective approach is integrated governance: one risk assessment process, one documentation system, one evidence trail that satisfies both frameworks. Privacy teams are uniquely positioned to lead this integration, given their existing GDPR infrastructure and experience with risk-based regulation.
The organizations that get this right will not just avoid fines — they will build AI systems that are genuinely trustworthy, which is increasingly what customers and business partners demand.