AI and GDPR: where they overlap and where they pull apart

A dangerous belief circulates in AI projects, namely that the AI Act has somehow replaced or absorbed the GDPR on the terrain of artificial intelligence. The two rules, in reality, apply in parallel and in full: the AI regulation disciplines systems according to their risk, the GDPR disciplines personal data processing wherever it happens, and an AI system touching personal data answers to both, with different supervisory authorities, sanctions and logics. The Italian data protection authority made the point in the most concrete way, with the 15 million euro fine imposed on OpenAI (December 2024) grounded entirely in GDPR violations, legal bases and transparency first, without waiting for any AI Act deadline.

For anyone leading AI projects inside a company, the map of overlaps and tensions between the two rules is worth more than many hours of generic training, because that is where both the risks and the shortcuts that later present their bill are hiding.

Where the two rules row together

On three fronts the AI Act and the GDPR ask for converging things, and whoever has worked well on privacy starts with an advantage. The first front is self-knowledge: the record of processing activities under Article 30 GDPR and the AI systems census are cousin exercises, and a company with the first in order builds the second in half the time, often discovering that many rows coincide.

The second front is impact assessments. The GDPR's DPIA and the fundamental rights impact assessment the AI Act introduces for certain deployers of high-risk systems share their logical structure and a good part of the evidence: description of the processing, risks for people, mitigation measures. Making them talk inside a single process avoids duplications and inconsistencies between documents an authority would read side by side.

The third front is human oversight of decisions. Article 22 GDPR has limited for years decisions based solely on automated processing with legal or similarly significant effects on people, and the AI Act reinforces the principle with its oversight requirements for high risk: whoever has already designed processes with meaningful human intervention, not a rubber stamp, already owns the backbone of both compliances.

Where the tension comes from

The real friction sits in the underlying principles, because the GDPR was born to limit processing and contemporary AI thrives on abundance. Data minimisation asks to process only what is necessary, while model development pushes to collect everything that might serve. Purpose limitation binds data to the purpose declared at collection, while reuse to train or feed AI systems is almost always a new purpose, requiring a compatibility assessment or a legal basis of its own. Transparency demands understandable explanations, and the most powerful models remain the least explainable.

On this terrain the easy answers are almost always wrong. "The data is anonymous" rarely survives serious analysis, because the threshold of true anonymisation is high and pseudonymisation leaves data inside the GDPR perimeter. "We rely on legitimate interest" requires the documented balancing test, which for large-scale training is anything but a given, as the proceedings of European authorities have shown. "The supplier is compliant" overlooks that the company remains controller of its own processing, with responsibilities no contract transfers in full.

The method for holding them together

The operational way to govern the pair starts with an organisational move before a legal one: the DPO and the AI owner must work at the same table, with a process that intercepts every new AI use case before kickoff and asks it three questions in sequence. Is personal data involved, even indirectly? If so, on which legal basis and for which purpose, and is it the same purpose as the original collection? Does the decision the system supports produce significant effects on people, and if so how is human intervention designed?

The answers feed a single card per system, the same card used for the AI Act risk classification, and the pair of rules stops being two separate workstreams to become one process with two checklists. In our AI Rating this weave lives inside the Risk dimension, where privacy and AI Act are evaluated together and personal data gaps count among the critical gates, because unlawful processing is not a weakness for a weighted average, it is a condition that can stop the system.

The tension between data protection and AI ambition is never dissolved once and for all, it is administered case by case, and companies that administer it with method discover a precious side effect: constraints, taken seriously at design time, produce systems that are leaner on data and sturdier over time. If you want to understand where your organisation stands on this weave, measurement is the entry point: calendly.com/fabiolalli/zerofive, or hello@zerofive.ai. And the question to bring to the next committee is precise: of the AI systems active today, how many have a written legal basis for the data they consume?