Open data — Free forever
For every relevant AI Act Article, see the overlapping GDPR provisions and a one-line summary. Curated from Regulation (EU) 2024/1689 and Regulation (EU) 2016/679. 14 entries.
| AI Act | Topic | GDPR | Overlap summary |
|---|---|---|---|
| Article 4 | AI literacy | Article 39 | Both require staff training on data/AI handling. AI literacy extends scope to ALL staff, not just data-touching roles. |
| Article 9 | Risk management system | Article 35, Article 36 | AI Act risk-management ≠ GDPR DPIA but they coordinate. High-risk AI requires BOTH (Article 26(9)). |
| Article 10 | Data governance and quality criteria | Article 5(1)(d), Article 25, Article 32 | Article 10(5) explicitly references GDPR for special-category data processing during training. |
| Article 11 | Technical documentation | Article 30 | AI Act technical doc subsumes GDPR Article 30 record for AI-specific processing. |
| Article 13 | Transparency to deployers | Article 13, Article 14 | AI Act Art 13 → B2B transparency. GDPR Art 13/14 → B2C. Together cover the whole chain. |
| Article 14 | Human oversight | Article 22 | GDPR Art 22 right not to be subject to solely automated decisions = aligned with AI Act human-oversight obligation. |
| Article 15 | Accuracy, robustness, cybersecurity | Article 32 | AI Act Art 15 extends GDPR Art 32 with model-specific robustness (adversarial, drift, accuracy thresholds). |
| Article 26(9) | DPIA for high-risk AI | Article 35 | Direct cross-reference: high-risk AI deployers MUST do GDPR DPIA when processing personal data. |
| Article 27 | Fundamental rights impact assessment (FRIA) | Article 35 | FRIA is broader than DPIA (covers all fundamental rights, not only privacy). Often combined. |
| Article 50 | Transparency to natural persons (chatbots, deepfakes) | Article 13, Article 14 | AI Act Art 50 sets MINIMUM disclosure (it's an AI). GDPR adds purpose, retention, rights info. |
| Article 70 | Designation of national authority | Article 51, Article 55 | Some Member States merge AI authority with DPA (e.g. Spain AEPD). Others keep separate. |
| Article 72 | Post-market monitoring | Article 32 | AI Act post-market monitoring overlaps with GDPR continuous security review obligations. |
| Article 73 | Reporting of serious incidents (15 days) | Article 33, Article 34 | Different timelines (AI Act 15 days vs GDPR 72h). If incident involves personal data → BOTH apply. |
| Article 99 | Administrative fines | Article 83 | AI Act maxes at EUR 35M / 7%, GDPR at EUR 20M / 4%. Cumulative for same conduct prohibited (ne bis in idem). |
Bird&Bird and Hogan Lovells charge $5,000+ for the same cross-reference report. Run our free EU AI Act Classifier + grab this map for free.