How do the EU AI Act and GDPR interact for security teams?

The EU AI Act and GDPR are two separate EU laws that regulators treat as linked, so a security team building or deploying an AI system has to satisfy both at once rather than pick one framework. The European Data Protection Board has been working with the European Commission on joint guidelines to clarify exactly where the two laws overlap, and as of this explainer those guidelines were still being drafted rather than finalized.

What is the relationship between the AI Act and GDPR?

The two instruments are meant to be read together rather than as competitors. The European Data Protection Board has said the AI Act and EU data protection law should be considered complementary and mutually reinforcing instruments.

That matters because Union data protection law is fully applicable to the processing of personal data involved in the lifecycle of the AI systems, as explicitly recognised in Article 2(7) AI Act.

So an AI Act compliance program does not replace a GDPR program; it sits alongside it wherever personal data is involved.

Why does personal data processing matter across the AI lifecycle?

Most AI systems touch personal data at some stage, and regulators treat that fact as central to how the AI Act will be enforced. The EDPB has described the processing of personal data (which is often strictly intertwined with non-personal data) along the lifecycle of AI systems as a core element of the technologies the AI Act covers.

For security teams, this means data flows mapped for GDPR purposes, such as training data provenance, logging and vendor access, are the same flows that AI Act market surveillance will scrutinize.

Who oversees AI Act compliance when personal data is involved?

Member states are still assigning that role, and data protection authorities are a leading candidate for AI systems that touch personal data. The EDPB has recommended that DPAs should be designated by Member States as MSAs for the high-risk AI systems mentioned in Article 74(8) AI Act.

For some categories the designation is mandatory: DPAs must be designated as MSAs for high-risk AI systems listed in point 1 of Annex III AI Act, in so far they are used for law enforcement purposes, border management and justice and democracy.

But coordination with the separate EU AI Office, which supervises general-purpose AI models, is not yet settled; the EDPB has noted that no clear coordination is currently established in the AI Act between the AI Office and the DPAs/EDPB.

Security teams working with foundation model vendors should expect two separate regulatory contact points rather than one.

How do data protection impact assessments and fundamental rights impact assessments differ?

They are not the same document, but they can overlap. EDPB Legal Officer Gintarė Pažereckaitė has explained that data protection impact assessments under the GDPR are more horizontal, whereas fundamental rights impact assessments under the AI Act will be about specific cases.

She has said that if one needs a fundamental rights impact assessment, most likely you need a data protection impact assessment, but the reverse isn't necessarily true.

The forthcoming joint guidelines could determine that operators will be able to cover both FRIAs and DPIAs in one document.

The EDPB has also pointed to a close relationship between the data protection impact assessment and the fundamental right impact assessment in its own statement.

Does transparency mean the same thing under both laws?

Not exactly, but satisfying one can help with the other. Pažereckaitė has said meeting transparency requirements under the AI Act can help meet some requirements under the GDPR for general accountability.

The upcoming joint guidelines will look at how the data protection question arises in the context of its interplay with areas such as transparency, risk assessments, bias detection and accountability.

What guidance has already been published, and what is still coming?

The EDPB has already adopted Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models.

Separately, the EDPB has pinpointed the need to clarify the substantive and regulatory enforcement interplay between the application of the GDPR and other EU digital legislation, particularly the EU Artificial Intelligence (AI) Act.

According to A&O Shearman's summary of EDPB plenary materials, the EDPB has started to work on the Guidelines on interplay between the GDPR and the AI Act.

Representatives of the European Commission's AI Office have joined the plenary session and discussed future collaboration with the EDPB to ensure a coordinated approach to AI governance.

The EDPB has continued publishing related material into 2026, including a news item on EDPB and EDPS support strengthening EU's cybersecurity and easing compliance while protecting individuals' personal data.

What should security leaders do while the guidance is still forming?

Treat GDPR records of processing and data protection impact assessments as the foundation that an AI Act risk file will build on, rather than as a separate workstream, since regulators expect the two exercises to reference each other. Keep a single inventory of AI systems that flags which ones process personal data, since that flag is likely to determine which authority acts as market surveillance authority and whether a fundamental rights impact assessment is also owed. Build vendor due diligence so that foundation model providers can answer both data protection questions and AI Act transparency questions in one request, because the same underlying data flows feed both assessments. Finally, assign one internal owner to track the joint EDPB-Commission guidelines so that governance documents can be updated quickly once the guidance is finalized rather than rebuilt from scratch.