Zooming in on AI #15: Regulatory spaghetti and AI – how to make sense of the EU GDPR and the EU AI Act

As the Regulation (EU) 2016/679 (General Data Protection Regulation) (the EU GDPR) has been in effect since 2018, businesses now have the opportunity to consider where they can leverage their existing data protection governance to support compliance with EU Regulation 2024/1689, also known as the Artificial Intelligence Act (the EU AI Act)¹ . They will also need to understand where important differences exist and how to approach new or updated compliance measures.  In this blog we set out the key issues to consider and how to effectively navigate the two regimes together.

EU GDPR v EU AI Act – how do they differ? 

The EU GDPR has become a fact of modern-day business and has been widely copied into legislation around the world.  By contrast the EU AI Act has generally not inspired many lookalike laws, but nonetheless resonates with high level principles articulated in international instruments such as the OECD AI principles and the Council of Europe’s Framework Convention on Artificial Intelligence.

The integral difference between the EU GDPR and the EU AI Act lies in the fact that the EU AI Act is a product safety law that is specifically concerned with the safe development, deployment and use of AI systems, whereas the EU GDPR, by comparison, is a much broader fundamental rights law that enshrines individuals’ rights regarding the processing of their personal data. 

Before we turn to consider the areas of overlap and where existing compliance mechanisms can be leveraged, it is perhaps worth zooming out to take a bird’s eye view of the overall landscape.

Both the EU GDPR and the EU AI Act aim in general to be technologically neutral.  As a starting point, the EU GDPR applies to all personal data processing within both its jurisdictional and material scope irrespective of the risk profile of that data.  As such, personal data that may be thought to be relatively low risk – for instance employees’ work contact data, is subject to the same protections as sensitive health data, but the application of those protections will be different. The underlying ethos of the EU GDPR is very much to consider the context and to apply tests of necessity, and to consider what is appropriate.  More stringent security measures will, for instance, inevitably be more appropriate to higher risk data than anodyne data that is unlikely to cause harm.

While the principles behind the EU AI Act are similar to those of EU GDPR – in that it has always been presented as being risk orientated, the legislative approach is different, such that the rules that it enshrines are applied only to certain activities and certain use cases.   As is well known, the EU AI Act considers four different risk groups: (1) prohibited AI practices; (2) high risk; (3) limited risk; and (4) minimal risk AI systems.  It also contains provisions on General Purpose AI (GPIAs). You can read further about the obligations for high risk AI systems on our blog here, limited risk AI systems here, and GPIAs here. 

Given that many AI use cases involve the processing of data, a company may be caught in different ways under the two regimes. For example:

• A company may be a subject to the EU GDPR in respect of its operation of an AI system as a controller where that AI system involves the processing of personal data in its EU establishment and the company is directing the key elements of the processing activities.  The full panoply of the EU GDPR (applied proportionately), will arise, but it may be classed as a limited risk AI system under the EU AI Act (e.g. an AI chatbot assistant on a retail site).
• If a company develops an AI system which does not process personal data (e.g. road traffic system monitoring), this use of data will not be subject to the EU GDPR at all, but the company will still be a provider of a high-risk AI system under the EU AI Act.
• Where a company provides a recruitment system service that uses AI to make decisions, it is likely to involve the processing of personal data and therefore be subject to the EU GDPR, perhaps as a processor rather than a controller, if it is doing so on behalf of another company.  It may also qualify as a provider of a high-risk system under the EU AI Act.

A company which makes the key decisions in respect of an implemented biometric identification system that it is operating is likely to be a controller for that AI system under the EU GDPR and the deployer of a high-risk system under the EU AI Act. Businesses will therefore need to consider the overlap and differences in the context of their particular uses of AI. 

Leveraging compliance frameworks

Despite their differences, both the EU AI Act and the EU GDPR are focused on ensuring the responsible and ethical use of technology, and to some extent there are compliance duties which could be read across from one piece of law to the other. In particular, businesses can look to harmonise their compliance efforts under both frameworks in areas such as transparency, technical and operational measures and governance.   This requires careful mapping, but we have set out a snapshot below of some areas of overlap that companies can consider tackling together.

You can read more about how governance can foster responsible AI in our blog post here. There is now a significant trend towards companies integrating and aligning their compliance functions for areas such as data protection and AI. The International Association of Privacy Professionals (IAPP) also researched this trend in their 2024 report on Organizational Digital Governance.

Companies should consider adoption of relevant standards for AI system conformity. In the EU this will involve standards issued by CEN, the European Committee for Standardization. Globally, this will also include standards issued by ISO and NIST on AI risk management. Companies may decide to adopt one standard as the overall approach for their company or develop an approach that integrates relevant components into their own bespoke governance framework. This will depend on which markets are key to their AI development and deployment and how they are using the technology.

Oversight and enforcement of EU GDPR and the EU AI Act

It is likely, and in certain cases imperative as per Article 74(8) of the EU AI Act, that some Data Protection Authorities under the EU GDPR will play a role in the oversight and enforcement of the EU AI Act. The EU AI Act gives EU Member States discretion as to the structure and design of these three types of authorities: Market Surveillance Authorities, Notifying Authorities and National Public Authorities. Read more about the types of authorities here, and access a table outlining the authorities that Member States have designated so far.

Member States are still deciding how to implement these structures, but some different examples are emerging. For example, Spain will establish an Artificial Intelligence Supervisory Agency (AESIA) acting as a Market Surveillance Authority under the Department of Digital Transformation. In contrast, Luxembourg has proposed The National Commission for Data Protection (CNPD), its national data protection authority, to act as its Market Surveillance Authority.

Therefore, companies will need to be prepared for engagement that spans multiple regulators in some Member States. Given the regulatory overlap explained above, it is of course possible that companies will encounter sanctions (and monetary penalties) under both regimes, although the EU AI Act requires that regard be given other fines that have been applied in respect of the same activity/lack of activity (Article 99(7)).

What are the tensions when applying EU GDPR to AI systems?

Although the EU GDPR is not intended to conflict with the EU AI Act, its robust and comprehensive approach to data protection presents certain challenges for the rollout of AI technologies. In the last year the European Data Protection Board and some national Data Protection Authorities (DPAs) have issued guidance that have addressed some of the areas of challenge, but we discuss below some of issues that still remain.

What impact will EU GDPR have on innovation and AI?

Guidance issued in 2024 by the EDPB and national DPAs (such as the CNIL In France) were important milestones in the developing a deeper understanding of how EU GDPR will apply to AI. In December 2024, the UK Information Commissioner’s Office (ICO) also issued its response toits consultations on Generative AI on the basis of the United Kingdom General Data Protection Regulation (the UK GDPR).

The resulting guidance has set out compliance approaches for companies to follow when developing and deploying AI models and systems, but the interpretation of the EU GDPR/UK GDPR has shown little flexibility and pragmatism. For example, the approach taken by the EDPB to anonymity and AI models indicates a regulatory posture that assumes that the EU GDPR is likely to apply equally to all parts of the AI supply chain, including the models themselves. Furthermore, a high bar has been set for companies to apply legitimate interests and how to meet transparency requirements under the EU GDPR.

Additionally, the ICO has sent a message that it expects companies to carefully consider whether they are working together as joint controllers when one company deploys an AI model that is developed by another. This is in contrast to a processor-controller or independent controller- independent controller model for the developer and deployer. Joint controller models are likely to be complex to implement at scale, when there can be thousands of deployment of AI models.

Concerns have been expressed that overly narrow interpretations of data protection laws may reduce innovation and result in a far more cautious approach than the rest of the world, especially given the attention from privacy activists such as Max Schrems/NYOB. We can expect a wider policy debate in 2025 about whether the interpretation of EU GDPR is creating a fair balance between protection against risk and harms, and supporting innovation.

In 2024 an open letter was written by a number of technology companies about the risks of regulatory uncertainty in the EU. The letter noted: “If companies and institutions are going to invest tens of billions of euros to build Generative AI for European citizens, they require clear rules, consistently applied, enabling the use of European data. But in recent times, regulatory decision making has become fragmented and unpredictable, while interventions by the European Data Protection Authorities have created huge uncertainty about what kinds of data can be used to train AI models”.

In the meantime, effective and joined up governance for the EU GDPR and the EU AI Act remain critically important to successfully implementing AI systems.