EU AI Act vs GDPR: two regimes your agents must satisfy

No, and assuming so is one of the most expensive misconceptions in the market. The GDPR governs personal data — lawful basis, purpose limitation, data-subject rights, security of processing — while the AI Act governs the AI system itself by its risk and role: classification, transparency, human oversight and conformity. Those are orthogonal questions. An agent can process personal data flawlessly and still breach the AI Act's Article 50 duty to disclose that a user is dealing with an AI, and conversely a transparent, low-risk agent can still mishandle personal data and breach the GDPR. They also have different timelines, different regulators in many member states, and different penalty structures. The correct mental model is two separate lenses on the same system, not one checkbox. Treat GDPR work as necessary but not sufficient, then add the AI-Act-specific controls — disclosure, oversight, risk classification and audit logging — on top of, not instead of, what you already do for data protection.

They are separate regimes but not disjoint, and they meet most sharply around automated decisions and data. The GDPR restricts solely automated decision-making that has legal or similarly significant effects on a person, and the AI Act may classify that very same system as high-risk, so an agent that screens job applicants or scores credit can trigger obligations under both at once. Data minimisation is another meeting point: what an agent retains in long-term memory is simultaneously a GDPR question about necessity and retention and an agent-security question about what an attacker could reach. Transparency overlaps too — the GDPR requires informing data subjects about processing, while the AI Act requires disclosing AI involvement, two different duties that often land at the same user touchpoint. The practical implication is not that one duty satisfies the other; it is that a single feature can create parallel obligations you must satisfy together, ideally with shared documentation so you are not solving the same problem twice in two languages.

Neither takes precedence; both apply in parallel and neither overrides the other, so the practical answer is to satisfy the union rather than pick a winner. The cleanest way to operationalise that is to run two mappings over the same agent. For the GDPR, map the data flows: what personal data the agent reads, stores, transmits and retains, on what lawful basis, and for how long. For the AI Act, map the behaviour and risk: whether the agent interacts with people, generates or manipulates content, or operates in a high-risk domain from Annex III. Then implement the combined set of controls — your existing GDPR safeguards plus AI-Act additions like Article 50 disclosure, human oversight and signed audit logs — and document accountability once in a way that covers both. Sequencing only matters for project planning, not legal priority: whichever you tackle first, you are not done until both are satisfied, because a regulator under one regime will not excuse a breach of the other.

Both regimes split responsibility by role, but they slice it differently, so you need to map your position under each rather than assume the vendor carries the risk. Under the GDPR the axis is controller versus processor: if you decide why and how personal data is processed you are the controller and hold the primary duties, even when a vendor does the processing on your behalf under a data-processing agreement. Under the AI Act the axis is provider versus deployer: the provider develops or places the AI system on the market, while you, running it in your own context, are typically the deployer, and deployers carry real obligations of their own — using the system as intended, ensuring human oversight, and meeting Article 50 disclosure where you are the one interacting with end users. Crucially, you can be a GDPR controller and an AI Act deployer at the same time for the same agent, and buying from a compliant vendor does not transfer your deployer or controller duties. Pin down both role pairs in writing, allocate the specific obligations in the contract, and keep the evidence that each side is meeting its part.