EU AI Act vs GDPR: Leveraging Your GDPR Framework for AI Act Readiness

If your organisation already runs a mature GDPR programme, you have a significant head start on the EU AI Act. Both regulations are risk-based, extraterritorial, documentation-heavy, and enforced with turnover-linked fines. This guide maps the parallels — and the important gaps — so you can reuse what you already have and focus new effort where it actually matters.

Why the comparison matters

The EU AI Act is often described as "GDPR for AI". That's a useful mental model, but it hides real differences. GDPR governs the processing of personal data. The AI Act governs the placing on the market and use of AI systems — whether or not they process personal data. Where the two overlap (most business-critical AI does process personal data), your GDPR controls are directly reusable. Where they don't, you need new structures.

Side-by-side: the two regulations at a glance

Dimension	GDPR (2018)	EU AI Act (2024, phased through 2027)
Subject matter	Processing of personal data	Design, placing on the market, and use of AI systems
Risk model	Risk to rights and freedoms of data subjects	Four tiers: unacceptable, high, limited, minimal
Primary duty holder	Controller (and processor)	Provider (and deployer, importer, distributor)
Extraterritorial reach	Yes — targeting or monitoring EU data subjects	Yes — output used in the EU
Core documentation	Records of processing (Art. 30), DPIA	Technical documentation (Annex IV), risk management file, post-market monitoring
Transparency to individuals	Privacy notice, Art. 13/14	AI transparency obligations (Art. 50), incl. deepfake and chatbot disclosure
Human oversight	Art. 22 automated decision-making rights	Art. 14 human oversight requirements for high-risk AI
Fines (upper tier)	€20m or 4% global turnover	€35m or 7% global turnover (prohibited AI); €15m or 3% (high-risk breaches)
Regulator	National DPAs, EDPB	National market surveillance authorities, EU AI Office

Where GDPR maps cleanly onto the AI Act

1. Risk-based thinking

GDPR's DPIA already trains your teams to reason about risk to individuals. The AI Act extends that muscle to safety, health, and fundamental rights more broadly. Your DPIA methodology, thresholds, and sign-off workflow can be extended into a Fundamental Rights Impact Assessment (FRIA) for high-risk AI (Art. 27), rather than rebuilt from scratch.

2. Records of processing → AI system inventory

Article 30 records are the closest existing analogue to the AI Act's requirement to maintain an inventory of AI systems in use, with purposes, data sources, and responsible owners. In practice, most organisations extend their RoPA schema with AI-specific fields (model type, provider, risk tier, human oversight arrangement) instead of standing up a parallel register.

3. Data governance and quality

AI Act Art. 10 requires training, validation, and test datasets to meet quality criteria — representative, relevant, free of errors, and appropriately governed. Your GDPR data quality, minimisation, and lineage controls are directly reusable. The new work is dataset-level bias testing and documenting representativeness for the intended context of use.

4. Transparency

Your Art. 13/14 privacy notice pipeline is the natural place to add AI Act Art. 50 disclosures ("you are interacting with an AI system", deepfake labels, emotion-recognition notices). Keep them in one governed content workflow instead of two.

5. Vendor and processor management

DPAs, sub-processor registers, transfer impact assessments — all reusable. The AI Act layers on provider vs deployer role classification and, for general-purpose AI models, upstream documentation flowing from the model provider to you as the deployer. Extend your vendor onboarding checklist rather than duplicating it.

6. Incident response

GDPR's 72-hour breach notification pipeline is a strong foundation. The AI Act adds serious incident reporting for high-risk AI (Art. 73) — a different trigger and recipient, but the same detect-triage-notify-remediate loop.

Where the AI Act goes beyond GDPR

• Prohibited practices (Art. 5): social scoring, untargeted scraping of facial images, emotion recognition at work or school, and more. GDPR has no direct equivalent — this is a hard product-design constraint.
• Conformity assessment and CE marking for high-risk AI. This is product-safety territory, closer to the Medical Devices Regulation than to GDPR.
• Post-market monitoring (Art. 72) — a continuous obligation to observe real-world performance and log deviations. GDPR has nothing equivalent.
• General-purpose AI model obligations for foundation-model providers, including systemic-risk models above the 10^25 FLOPs threshold.
• AI literacy (Art. 4) — an organisation-wide competence obligation for anyone operating AI systems, including staff and contractors.

A practical reuse plan

1. Map your AI systems onto the four risk tiers. Most business AI lands in limited (transparency-only) or high-risk (Annex III use cases such as recruitment, credit scoring, biometric ID, critical infrastructure).
2. Extend your RoPA into an AI inventory. Add: risk tier, provider vs deployer role, human oversight owner, model provider, dataset lineage.
3. Upgrade DPIA into DPIA + FRIA for high-risk systems. Same governance forum, expanded impact scope.
4. Amend vendor DPAs to cover AI Act provider/deployer duties and general-purpose AI model documentation flow.
5. Add AI-specific transparency snippets to your existing privacy-notice CMS.
6. Extend incident response with a serious-incident branch and the correct regulator routing.
7. Roll out AI literacy training — reuse your privacy-training cadence and LMS.

Fine exposure: sizing the risk

GDPR set the ceiling at 4% of global turnover. The AI Act raises the top tier to 7% for prohibited practices and 3% for high-risk breaches — with SMEs benefiting from proportionality. For a €500m-turnover company, that is up to €35m for a single prohibited-practice finding. Treat unacceptable-risk classification as a board-level red line, not a compliance-team judgement call.

Timeline you need to plan against

• February 2025 - prohibited practices and AI literacy obligations already in force.
• August 2025 - general-purpose AI model rules and governance apply.
• August 2026 - Article 50 transparency obligations (chatbots, deepfakes, synthetic-content labelling) apply.
• December 2027 - stand-alone Annex III high-risk AI (HR, credit, biometrics, education, essential services) applies, following the Digital Omnibus (Reg. (EU) 2026/1744, in force 27 July 2026).
• August 2028 - high-risk AI embedded in Annex I regulated products (medical devices, machinery, vehicles, toys) applies.

If your GDPR programme took two years to mature, you don't have that luxury for the AI Act. The reuse strategy above is how organisations close the gap in months instead of years.

Where to start this week

Run an AI system discovery workshop with IT, procurement, and business owners, and classify each system into the four risk tiers. That single artefact drives every downstream decision — inventory scope, FRIA prioritisation, vendor renegotiation, and training rollout.

Our free AI Act readiness assessment walks you through this exact classification in about 15 minutes and gives you a personalised report you can take to your steering committee.