--- title: "AI Act Meets GDPR: Where the Two Frameworks Overlap | Pitch" description: "How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special…" url: https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap --- [pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # AI Act Meets GDPR: Where the Two Frameworks Overlap How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories. - - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law - 25 February 2026 - Updated 30-10-2026 ## The legal framework The AI Act ([Regulation (EU) 2024/1689](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)) and the GDPR ([Regulation (EU) 2016/679](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)) apply at the same time. The AI Act says so itself: it is without prejudice to Union data protection law ([Article 2(7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_2)). The GDPR is triggered by the processing of personal data. The AI Act is triggered by the placing on the market or use of an AI system, whether or not personal data are involved. Most business AI systems fall under both. ### Roles do not line up The AI Act speaks of providers and deployers. The GDPR speaks of controllers and processors. A [deployer](https://pitch.law/academy/provider-vs-deployer-ai-act) is usually the controller of the personal data it feeds into a system. A provider may be a processor, a joint controller, or an independent controller, for example when it uses customer data to improve its model. The roles must be determined separately under each regime and written into the contract. ### Impact assessments - A **DPIA** (GDPR [Article 35](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_35)) is required where processing is likely to result in a high risk to individuals, including systematic evaluation with significant effects, large-scale special category data and systematic monitoring. - A **fundamental rights impact assessment** (AI Act [Article 27](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_27)) is required before first use of a high-risk system by public bodies, private entities providing public services, and deployers of certain credit-scoring and insurance systems. It covers all fundamental rights, not just privacy. - Where both apply, the FRIA may complement the DPIA ([Article 27(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_27)). The assessments overlap but neither replaces the other. Deployers of high-risk systems use the provider's information to carry out their DPIA ([Article 26(9)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_26)). ### Automated decisions and transparency GDPR [Article 22](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_22) gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, with exceptions that require safeguards such as human intervention. In _SCHUFA_ ([C-634/21](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634)), the Court of Justice held that a probability score can itself be such a decision where a third party draws strongly on it. The AI Act adds a right to an explanation of the role of a high-risk system in a decision ([Article 86](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_86)), human oversight (Article 14), and the information duties of Articles 13 and 26. GDPR Articles 13 to 15 require meaningful information about the logic involved. ### Data quality, bias and special categories Providers of high-risk systems must use training, validation and testing data that is relevant, representative and as free of errors as possible ([Article 10](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_10)). To detect and correct bias, [Article 4a](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744#art_1), which the Digital Omnibus on AI put in place of Article 10(5), lets providers process special category data under strict conditions, such as strict necessity, technical safeguards, deletion after use and a note in the records of processing explaining why it was needed. This is an AI Act basis for the purpose; the GDPR's general principles, including data minimisation and purpose limitation, still apply. The European Data Protection Board addressed the use of personal data in AI models in its [Opinion 28/2024](https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en). ### Other points of contact - **Records and accountability.** GDPR Article 30 records and AI Act technical documentation should be maintained together to avoid contradictions. - **Breach and incident reporting.** A personal data breach goes to the data protection authority within 72 hours ([Article 33](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_33)). Serious incidents with high-risk systems are reported under [Article 73](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_73) AI Act. One event can trigger both. - **Supervision.** The data protection authority supervises the GDPR. The AI Act uses market surveillance authorities designated by each Member State. Check who is competent in your sector. ## In practice A Hasselt insurance broker uses an AI tool to triage claims and flag suspected fraud. The broker as controller needs a lawful basis, privacy notices that mention the profiling, and a DPIA. Because a flag can lead to a refused claim, Article 22 requires a claims handler to make the real decision, with the ability to depart from the tool's recommendation. It documents oversight under the AI Act and uses one assessment file for both frameworks, with separate sections where the legal tests differ. ## Frequently asked questions ### If we comply with the GDPR, are we compliant with the AI Act? No. The AI Act has requirements, such as risk management, documentation and conformity assessment, that the GDPR does not contain. ### Does a DPIA satisfy the fundamental rights impact assessment? Not by itself. It can serve as a basis, but the FRIA must cover wider rights and the AI Act's content requirements. ### Can we use special category data to test for bias? Under [Article 4a](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744#art_1) of the AI Act (formerly Article 10(5)), if the conditions are met and no other data would do. Document the necessity and safeguards. ### Who answers a data subject's request about an AI decision? The controller. The provider should support the controller through contract. ## How this connects In [AI Act compliance](https://pitch.law/solutions/ai-act-compliance) we treat both frameworks together. [Our compliance registers](https://pitch.law/technologies/privacy-register) keep the GDPR records of processing next to the AI Act records, and [our DPIA tool](https://pitch.law/technologies/digital-data-protection-impact-assessment) lets you and your attorney complete assessments as one working record. See also [building an AI governance framework](https://pitch.law/academy/building-an-ai-governance-framework). ## In short - Why compliance with one framework does not replace the other - DPIA and fundamental rights impact assessment compared - Automated decisions and transparency - Bias testing and special category data ## Related solutions - [Solutions](https://pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://pitch.law/solutions/ai-act-compliance) ## Technology we use - [Technology](https://pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://pitch.law/technologies/ai-act-governance-toolkit) - [Technology](https://pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://pitch.law/technologies/privacy-register) - [Technology](https://pitch.law/technologies/digital-data-protection-impact-assessment) ### [Data Protection Impact Assessment](https://pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://pitch.law/technologies/digital-data-protection-impact-assessment) ## More in Legal Aspects of Artificial Intelligence - ### [EU AI Act Timeline: Every Date from 2024 to 2030](https://pitch.law/academy/ai-act-compliance-timeline) [The AI Act applies in stages from 2 February 2025 to 31 December 2030. Every date, what applies and who it affects, with the 2026 high-risk postponement.](https://pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Risk Classification: the Four Risk Levels](https://pitch.law/academy/ai-act-risk-classification-explained) [The AI Act sorts AI into unacceptable (prohibited), high, limited (transparency) and minimal risk. How to tell which level your AI system falls in.](https://pitch.law/academy/ai-act-risk-classification-explained) - ### [AI Clauses in Vendor Contracts: 9 Terms to Negotiate](https://pitch.law/academy/ai-clauses-in-vendor-contracts) [The AI clauses to negotiate when you buy or supply AI: AI Act roles, training on your data, output ownership, IP indemnity, audit and logs, liability.](https://pitch.law/academy/ai-clauses-in-vendor-contracts) - ### [AI Act in HR and Recruitment: the High-Risk Rules](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Recruitment and HR AI is usually high-risk under the AI Act (from 2 December 2027), and emotion recognition at work is banned. What employers must do.](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data and Copyright](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) - ### [The AI Literacy Obligation](https://pitch.law/academy/ai-literacy-obligation-businesses-overlooking) [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://pitch.law/academy/ai-literacy-obligation-businesses-overlooking) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://pitch.law/schedule)