Crosswalk
EU AI Act ↔ GDPR
The EU AI Act does not replace GDPR — they apply cumulatively. GDPR governs personal-data processing (including by AI); the EU AI Act adds product-safety-style obligations for AI systems regardless of whether personal data is involved. Practical overlap: an automated hiring system in the EU triggers Article 22 GDPR, Article 35 DPIA, and Annex III + Article 27 FRIA under the AI Act.
| EU AI Act | GDPR | Notes |
|---|---|---|
Article 27 FRIA Fundamental rights impact assessment | Article 35 DPIA Data protection impact assessment | FRIA is broader (fundamental rights); DPIA is data-focused. Article 27(4) says a DPIA may satisfy parts of the FRIA. |
Article 26(11) Notification of natural persons | Article 13, 14 Right to be informed | Deployers must tell affected people an AI is used. |
Article 10 Data governance | Article 5 Principles of processing | Accuracy, minimization, purpose limitation. |
Article 26(6) Logs for 6 months | Article 30 Records of processing | Log obligations align. |
Article 5(1)(b) Prohibited exploitation of vulnerabilities | Article 22 Automated decisions | Both regulate manipulation and profiling. |
Article 50 transparency Chatbot, deepfake disclosure | Article 13, 14 Information at collection | Layered notices. |
Article 26(10) Human oversight | Article 22(3) Human review of automated decisions | Direct alignment. |
Article 78 Confidentiality | Article 5(1)(f) Integrity and confidentiality | Both require safeguards. |
What to watch
Key differences
- · GDPR applies whenever personal data is processed; the AI Act applies to any AI system placed on the EU market, regardless of personal data.
- · GDPR fines cap at €20M or 4% turnover; AI Act tops out at €35M or 7% for prohibited practices.
- · GDPR is enforced by DPAs; AI Act is enforced by market-surveillance authorities + AI Office.
- · Article 22 GDPR is a rights-based individual right; AI Act is product-safety-style obligations on providers/deployers.
Primary sources
Where every mapping was verified
Next steps
Turn a crosswalk into an audit-ready posture
Free vendor matchmaking
Need vendors that cover both frameworks?
Get matched with vendors that ship controls, evidence, and mappings across both frameworks on this page.
No sign-up. Independent directory — we do not sell software ourselves.