Home › Compare laws side by side › EU AI Act vs EU GDPR
EU AI Act vs EU GDPR
Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (AI Omnibus) (European Union) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | EU AI Act European Union ✓ Confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force since 1 Aug 2024, applying in stages. The AI Omnibus (in force 27 Jul 2026) moved stand-alone high-risk rules to 2 Dec 2027 and product-embedded high-risk rules to 2 Aug 2028.✓ | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | Providers placing AI systems on the EU market, deployers using AI in the EU, and providers or deployers outside the EU whose AI output is used in the EU.✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | None for prohibitions and transparency duties. Obligations depend on the AI system's risk level and your role (provider, deployer, importer, distributor).✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | European AI Office (general-purpose AI models and some AI in very large platforms) and national market surveillance authorities✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | Now: providers of general-purpose AI models with systemic risk must report serious incidents to the AI Office without undue delay (Art 55). From 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I): high-risk providers report serious incidents to the market surveillance authority within 15 days; 10 days if a death; 2 days for widespread infringements or serious critical-infrastructure disruption (Art 73).✓ | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | N/A✓ | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | N/A (AI literacy measures required under Art. 4, as amended by the AI Omnibus)✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | Non-EU providers of high-risk AI systems and of general-purpose AI models must appoint an EU authorised representative by written mandate (open-source GPAI models without systemic risk are exempt).✓ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | N/A✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | N/A✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | Up to EUR 35m or 7% of worldwide turnover for prohibited practices; EUR 15m or 3% for other obligations incl. high-risk and transparency; EUR 7.5m or 1% for misleading info (whichever higher; SMEs pay the lower).✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- EU AI Act
- Providers placing AI systems on the EU market, deployers using AI in the EU, and providers or deployers outside the EU whose AI output is used in the EU.
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under EU AI Act
- Stop any prohibited AI practice (banned since 2 Feb 2025); new bans on AI nudification and child-abuse imagery apply from 2 Dec 2026.
- Tell people when they interact with an AI system; mark AI-generated content (Art. 50, from 2 Aug 2026; marking grace to 2 Dec 2026 for systems already on the market).
- Check whether each AI system is high-risk; if you rely on the Art 6(3) exception for an Annex III system, document the assessment (Art 6(4)) and register the system in the EU database before market (Art 49(2), simplified procedure).
- High-risk providers: risk management, data governance, logging, human oversight, conformity assessment by 2 Dec 2027 (Annex III) or 2 Aug 2028 (product-embedded).
- General-purpose AI model providers: technical documentation, copyright policy and a training-content summary (since 2 Aug 2025).
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@