What is the difference between GDPR and the AI Act?
GDPR regulates personal data processing; the AI Act regulates AI systems by risk category and role in the AI value chain.
GDPR vs AI Act: GDPR applies when personal data is processed; the AI Act applies when an AI system or GPAI model falls within the EU AI framework. A single product can trigger both if it uses personal data inside an AI system. Sources: EUR-Lex: GDPR; EUR-Lex: Artificial Intelligence Act.
The short version
GDPR is a data-protection law centred on personal data, lawful bases and individual rights. The AI Act is a product- and system-governance law centred on AI risk, provider/deployer roles and market controls.
Side by side
Regulation
GDPR
General Data Protection Regulation
- What it is
- The GDPR is the EU's horizontal rulebook for personal data processing and data protection rights.
- Scope
- Personal data processing by controllers and processors, including many non-EU organisations that target or monitor people in the EU.
- Who it applies to
- Controllers, processors and other organisations that determine, perform or support personal data processing covered by the GDPR.
- Key dates
- Adopted in 2016.
- Applicable from 25 May 2018.
- Core obligations
- Have a lawful basis for processing personal data.
- Provide transparency, data-subject rights and security measures.
- Use governance measures such as records, processor contracts, DPIAs and breach notification where required.
- Penalties
- Supervisory authorities can impose administrative fines up to EUR 20 million or 4% of annual worldwide turnover for the highest tier of infringements.
Regulation
AI Act
Artificial Intelligence Act
- What it is
- The AI Act is the EU's horizontal AI framework, organised around prohibited practices, high-risk systems, transparency duties and GPAI obligations.
- Scope
- AI systems placed on the EU market, put into service or used in the EU, including some providers and deployers outside the EU when outputs are used in the Union.
- Who it applies to
- Providers, deployers, importers, distributors, product manufacturers and authorised representatives depending on their role in the AI value chain.
- Key dates
- Entered into force on 1 August 2024.
- Most rules apply from 2 August 2026, with phased earlier and later dates for specific chapters.
- Core obligations
- Avoid prohibited AI practices and meet transparency duties where triggered.
- For high-risk AI, maintain risk management, data governance, technical documentation, logging, human oversight, accuracy and post-market monitoring.
- For general-purpose AI models, provide technical documentation and transparency information, with extra duties for models with systemic risk.
- Penalties
- The highest tier reaches EUR 35 million or 7% of annual worldwide turnover for prohibited-practice infringements; lower tiers apply to other obligations and incorrect information.
Which applies to you?
If you process personal data, start with GDPR. If you provide, deploy, import or distribute an AI system in the EU, check the AI Act. If the AI system uses personal data, assume both workstreams may matter.
Frequently asked
Does GDPR still apply after the AI Act?
Yes. The AI Act does not replace GDPR. Personal data processing remains subject to GDPR even when the same system is also regulated by the AI Act.
Which law has higher headline fines?
The AI Act's highest tier is EUR 35 million or 7% of annual worldwide turnover for prohibited-practice infringements. GDPR's highest tier is EUR 20 million or 4% of annual worldwide turnover.
Can one AI product be in scope of both?
Yes. An AI system can be subject to the AI Act because it is an AI system, and to GDPR because it processes personal data.
Official sources
Comparisons are grounded explainers, not legal advice. Use the linked EUR-Lex texts and official sources for binding legal wording.
Related terms
Does this comparison affect your company?
Enter your company and Lex builds a cited Exposure Map in about 30 seconds. Free, no login.