What is the difference between the AI Act and GDPR?

Data or risk: how does the scope differ?

For GDPR, start with personal data, the processing purpose and the applicable territorial and material scope. A name, email address or photograph can be personal data, but its presence alone does not settle every question of applicability. Exceptions also exist.

For the AI Act, check the system’s intended purpose and the organisation’s role. A system can be in scope without personal data. A safety component in electricity or water supply may be high-risk under the legal conditions; that does not classify every piece of infrastructure software.

For recruitment or credit assessment, examine both regimes. Compliance with one does not establish compliance with the other.

How do the fine ceilings differ?

Under GDPR Article 83, the ceilings depend on the breach: EUR 10 million or 2%, and EUR 20 million or 4%. For an undertaking, compare the fixed amount with the percentage of total worldwide annual turnover for the preceding financial year and take the higher figure.

AI Act Article 99 has separate ceilings: EUR 35 million or 7% for prohibited practices, EUR 15 million or 3% for the other listed breaches, EUR 7.5 million or 1% for specified breaches involving information provision. The general rule takes the higher figure; qualifying SMEs use the lower one. Relief for small mid-cap enterprises (SMCs) does not cover the prohibited-practices ceiling. Again, the percentage concerns total worldwide annual turnover for the preceding financial year.

These are maxima, not automatic penalties. The particular breach, circumstances, enterprise category and procedure need separate assessment. Do not add the percentages together as a ready-made liability calculation.

How do DPIA and FRIA differ?

A DPIA is a data protection impact assessment. GDPR Article 35 requires one before processing likely to result in a high risk to people’s rights and freedoms. Using AI is not the sole criterion.

A FRIA is the fundamental rights impact assessment under AI Act Article 27. It covers specified deployers and high-risk uses: bodies governed by public law, private organisations providing public services, and the specified credit and insurance uses. Annex III point 2 is excluded from this scope. Not every insurance product or AI system requires a FRIA.

Where obligations have already been fulfilled through a DPIA, the FRIA complements it. The existing assessment does not automatically replace the AI Act assessment. Compare the questions covered and the gaps; check the applicable date and transitions for the particular use.

Which authority is competent for your case?

GDPR has national data protection authorities, with rules for cross-border cases. Under the AI Act, competence depends on the system, role and relevant national or European procedure. Do not assume both regimes use the same authority.

For a particular case, check the current rules and the competent authority in your member state.

Questions

Sources

• Regulation (EU) 2016/679 — GDPR.
• Regulation (EU) 2024/1689 — AI Act.
• Regulation (EU) 2026/1744 — amendments.
• European Data Protection Board — oversight and fines.

Related reading

• Do you need to label content made with AI?
• What does AI literacy under Article 4 of the EU AI Act require?
• Digital Omnibus: which AI Act dates changed?