How does the GDPR apply to an artificial intelligence system?

An artificial intelligence system that processes personal data does not leave the GDPR's scope simply because it is labeled "AI": training, inference and output remain personal data processing in every sense, whenever they involve information that identifies or renders identifiable a person. This holds even when no personal data is visible in the output: a model trained on CVs or customer conversations has already processed that data during training, and a generic final answer does not erase the upstream obligation. The friction point with the AI Act is that the two regulations use different vocabularies: the AI Act separates whoever builds the system (provider) from whoever uses it (deployer), the GDPR whoever decides why and how data is processed (controller) from whoever processes it on their behalf (processor). A company can be a controller under the GDPR and a deployer under the AI Act for the same system: the two regulations need to be read together.

See also: Cookie consent · The mechanism a site uses to collect consent before installing non-technical cookies, with no pre-ticked choices.

Where the GDPR actually bites

The first friction point is the legal basis for training: many training datasets contain data collected for other purposes, for instance CRM logs or customer service emails, and reusing them to train a model requires its own legal basis, not one automatically inherited from the original purpose. Legitimate interest is the most common route, but it requires a documented three-step test: identifying the interest, verifying its necessity, balancing it against the rights of the person the data is about. The second is Art. 22 GDPR on automated decisions: when an AI system makes or materially supports decisions with legal or otherwise significant effects on a person, typically hiring decisions, credit scoring or insurance pricing, specific rights kick in (human intervention, explanation of the logic, the ability to contest) that a generic chatbot does not trigger but a scoring system does. The third is the impact assessment: the GDPR's DPIA (data protection impact assessment) covers the risk to personal data, while the AI Act's FRIA (fundamental rights impact assessment) looks at the risk to fundamental rights in the process the system is used in (see the FRIA entry for detail). They overlap but do not coincide, and Art. 27 of the AI Act explicitly allows reusing the DPIA where content overlaps, not replacing it.

Why it matters for companies adopting AI

The concrete risk is not ignoring the AI Act, which is on everyone's radar by now, but designing a system that is formally AI Act compliant while resting on a fragile GDPR legal basis for its training data, or conversely building a solid DPIA without ever checking the provider and deployer roles the AI Act requires. The two frameworks need to be mapped together starting from the system inventory: for each AI use case, who processes what under the GDPR and who is provider or deployer under the AI Act, with legal bases and impact assessments tracked once in a shared framework. The European Data Protection Board (EDPB) has already clarified several of these points in its opinion on AI models adopted in late 2024, in particular on model anonymization and legitimate interest, while joint guidelines specifically on the GDPR and AI Act interplay, prepared together with the Commission, had not been published on the EDPB website as of September 28, 2026: the area is still evolving, one more reason to build a governance process that can be updated rather than a one-off exercise.

This entry is informational and does not constitute legal advice: for decisions on regulated data, involve your DPO or legal counsel.