Anyone developing or deploying AI systems in the EU deals with two frameworks at once: the AI Act and the GDPR. They pursue different goals, use different terms and have different authorities — and yet they often concern the same system. This article shows where they overlap and how to implement both in one process rather than running two separate projects.
Different logic
The GDPR protects people when their data is processed. It applies as soon as personal data is processed, regardless of technology. The AI Act is at its core product regulation: it sets requirements for AI systems, tiered by risk, regardless of whether personal data is involved. The AI Act states expressly that it leaves data protection law unaffected. Both therefore apply side by side.
Different roles
The GDPR knows controllers and processors, the AI Act providers and deployers. The roles do not automatically coincide. A software house can be the provider of an AI system and at the same time a processor of its customers’ data; a company using an AI tool is a deployer and at the same time the controller of the processing. Roles are therefore determined separately per system and framework.
Transparency
The GDPR requires information on purposes, recipients and rights, set out in the privacy notice. Under Art. 50 the AI Act requires, among other things, that people learn when they interact with an AI and that certain AI content is labelled. The two duties complement each other: a chatbot needs the AI notice under the AI Act and information on processing of the data entered under the GDPR.
Automated decisions and human oversight
Art. 22 GDPR governs automated individual decisions with legal or similarly significant effect. For high-risk systems the AI Act requires human oversight and gives people affected by certain decisions a right to an explanation. In practice they interlock: a high-risk system for credit decisions needs effective oversight under the AI Act and data subjects’ rights under the GDPR.
FRIA and DPIA
The GDPR requires a data protection impact assessment where high risk to individuals’ rights is likely. The AI Act requires certain deployers of high-risk systems to carry out a fundamental rights impact assessment. The AI Act expressly provides that the FRIA complements a DPIA already carried out where the content overlaps. A joint document with a data protection part and a fundamental rights part is therefore sensible. How a DPIA is structured is described in when do you need a DPIA.
Data governance
For high-risk systems the AI Act requires training, validation and test data to be governed against quality criteria, including for detecting bias. For that purpose it also allows, under strict conditions, the processing of special categories of personal data. The GDPR remains decisive: legal basis, purpose limitation, data minimisation and storage limitation continue to apply. Good data governance meets both sets of requirements at once.
Supervision
The GDPR is enforced by data protection authorities, the AI Act by market surveillance authorities designated by member states; for certain areas data protection authorities are competent too. For companies this means an incident with an AI system can trigger questions from two authorities. Joint documentation makes the answer easier.
Implementing them together
1. Keep an AI inventory recording per system the role under the AI Act and the GDPR, the risk class and the data processed.
2. Design transparency jointly: AI notice and data protection information in the same place.
3. Merge impact assessments: a DPIA with a fundamental rights part where a FRIA is required.
4. Review contracts with AI vendors under both frameworks: processing, training, documentation, support with obligations.
5. For Switzerland, additionally consider the revised FADP, which also applies to AI applications.
The bigger picture of the AI Act is in our AI Act 2026 guide. We implement both frameworks together through our AI Act consulting and the FRIA and DPIA package.