EU AI Act vs GDPR: Clause-by-Clause Comparison

EU AI Act (Regulation 2024/1689) is regulatory and applies to Providers, deployers, importers, and distributors of AI systems placed on the EU market or whose output is used in the EU. Includes non-EU providers serving EU users. GDPR (Regulation 2016/679, Articles 22, 25, 35) is regulatory and applies to Any controller or processor handling personal data of EU residents, regardless of location. AI relevance via Article 22 (automated decisions), Article 25 (data protection by design), and Article 35 (DPIA). The practical tension is that both are EU regulations that reach the same AI system, but one governs the system and the other governs the personal data flowing through it. They are not substitutes. Across the fifteen governance dimensions compared here, 15 are addressed substantively by both, 0 are materially stronger in EU AI Act, and 0 are materially stronger in GDPR. Treating either as a superset of the other is the most common and most expensive mistake.

EU AI Act (Regulation 2024/1689) Type: Regulatory. Jurisdiction: European Union (extraterritorial). In force: August 1, 2024 (staggered through August 2, 2027). Exposure for getting it wrong: Up to EUR 35 million or 7% of global turnover (Article 99). Best suited to: Any organization shipping AI products to EU users or processing data of EU residents GDPR (Regulation 2016/679, Articles 22, 25, 35) Type: Regulatory. Jurisdiction: European Union + EEA (extraterritorial via Article 3). In force: May 25, 2018. Exposure for getting it wrong: Up to EUR 20 million or 4% global turnover (Article 83). Best suited to: Any organization processing EU resident personal data through AI The penalty asymmetry is usually what decides sequencing. Both carry real consequences, so the question is which applies to your jurisdiction and data first.

These are the dimensions both frameworks address substantively, which means one piece of evidence can often satisfy both. This is where a combined programme saves real effort rather than just feeling tidy. Governance + accountability. EU AI Act (Articles 17, 26): Article 17 requires a quality management system for high-risk providers; deployers need internal governance under Article 26. GDPR (Articles 24, 37): Article 37 requires a Data Protection Officer for public bodies and large-scale processors; Article 24 controller responsibility. Risk management process. EU AI Act (Article 9): Article 9 mandates a risk management system across the lifecycle of high-risk AI systems. GDPR (Article 35): Article 35 DPIA required for high-risk processing (profiling, large-scale special category, systematic monitoring). Data handling + minimisation. EU AI Act (Article 10): Article 10 sets quality, governance, and bias-testing requirements for training, validation, and test datasets. GDPR (Articles 5, 6, 9): Article 5 principles (lawfulness, minimisation, accuracy, storage limitation, integrity); Articles 6, 9 lawful basis. Model lifecycle controls. EU AI Act (Articles 9, 11, 17): Article 9, 11, 17 cover risk management, technical documentation, and quality management across lifecycle. GDPR (Articles 25, 32): Article 25 requires data protection by design and default; Article 32 security of processing across lifecycle. Transparency + disclosure. EU AI Act (Articles 13, 50, 53): Article 13 (high-risk) and Article 50 (chatbots, synthetic content) impose user-disclosure obligations; Article 53 covers GPAI documentation. GDPR (Articles 13, 14, 22(3)): Articles 13-14 provide information; Article 22(3) requires meaningful information about automated decision logic. Human oversight + intervention. EU AI Act (Articles 14, 26): Article 14 mandates effective human oversight for high-risk AI; specific roles per Article 26 for deployers. GDPR (Article 22(3)): Article 22(3) right to obtain human intervention, express point of view, contest the decision. The caveat worth stating: overlapping subject matter does not mean interchangeable evidence. EU AI Act and GDPR frequently want the same control documented to a different standard of proof, so plan to write once and format twice.

Neither framework outranks the other on obligation, so sequence by exposure. Work out which applies to your jurisdiction, your data and your customers first, and start there. EU AI Act is in force from August 1, 2024 (staggered through August 2, 2027); GDPR from May 25, 2018. In most organisations the deciding factor is commercial rather than legal: whichever one a buyer is already asking for in procurement is the one to complete first, because it unblocks revenue while the other unblocks risk.

Areebi does not certify you against either framework. What it does is produce the runtime evidence both of them ask for, from the same control plane, so the overlap above becomes real rather than theoretical. For EU AI Act: Article 12 logging obligations satisfied by immutable audit log with 6-month minimum retention. DLP + provider routing supports Article 10 data-governance and Article 15 cybersecurity. Per-tenant evaluation harness aligned with Article 14 human-oversight workflows. Incident-response runbook templates align with Article 73 reporting window. For GDPR: Article 32 security satisfied by encryption, access controls, and BYOK options. Article 30 records supported by per-tenant processing-activity logs. DPA + Article 28 sub-processor list maintained for tenant download. Article 22 contestability workflows hookable from Areebi response policy. The common thread is that both frameworks want to know what your AI systems actually did, not what your policy said they should do. That is an operational logging and enforcement problem before it is a documentation problem.