Crosswalk
EU AI Act ↔ GDPR
The EU AI Act does not replace GDPR — they apply cumulatively. GDPR governs personal-data processing (including by AI); the EU AI Act adds product-safety-style obligations for AI systems regardless of whether personal data is involved. Practical overlap: an automated hiring system in the EU triggers Article 22 GDPR, Article 35 DPIA, and Annex III + Article 27 FRIA under the AI Act.
| EU AI Act | GDPR | Notes |
|---|---|---|
Article 27 FRIA Fundamental rights impact assessment | Article 35 DPIA Data protection impact assessment | FRIA is broader (fundamental rights); DPIA is data-focused. Article 27(4) says a DPIA may satisfy parts of the FRIA. |
Article 26(11) Notification of natural persons | Article 13, 14 Right to be informed | Deployers must tell affected people an AI is used. |
Article 10 Data governance | Article 5 Principles of processing | Accuracy, minimization, purpose limitation. |
Article 26(6) Logs for 6 months | Article 30 Records of processing | Log obligations align. |
Article 5(1)(b) Prohibited exploitation of vulnerabilities | Article 22 Automated decisions | Both regulate manipulation and profiling. |
Article 50 transparency Chatbot, deepfake disclosure | Article 13, 14 Information at collection | Layered notices. |
Article 26(10) Human oversight | Article 22(3) Human review of automated decisions | Direct alignment. |
Article 78 Confidentiality | Article 5(1)(f) Integrity and confidentiality | Both require safeguards. |
What to watch
Key differences
- · GDPR applies whenever personal data is processed; the AI Act applies to any AI system placed on the EU market, regardless of personal data.
- · GDPR fines cap at €20M or 4% turnover; AI Act tops out at €35M or 7% for prohibited practices.
- · GDPR is enforced by DPAs; AI Act is enforced by market-surveillance authorities + AI Office.
- · Article 22 GDPR is a rights-based individual right; AI Act is product-safety-style obligations on providers/deployers.
Primary sources
Where every mapping was verified
Next steps
Turn a crosswalk into an audit-ready posture
Free vendor matchmaking
Need vendors that cover both frameworks?
Get matched with vendors that ship controls, evidence, and mappings across both frameworks on this page.
No credit card. Independent directory — we do not sell software ourselves.