GDPR and AI Act: A Synergistic Interaction for Ethical AI Governance

Table of Contents

• 1. Introduction: AI, personal data and regulation
• 2. Common objectives of the GDPR and the AI Act
• 3. A strategic complementarity
• 4. Differences in scope between GDPR and AI Act
• 5. Similarities in governance and compliance
• 6. Conclusion: responsible AI at the heart of Europe

# 1. Introduction: AI, Personal Data, and Regulation

Artificial intelligence (AI) is profoundly transforming our societies, in areas as varied as health, finance, mobility and education. However, this technological revolution raises numerous concerns: massive collection of personal data, algorithmic bias, opaque automated decisions, risks of surveillance or discrimination.

To regulate these practices, two major European texts now intersect: the GDPR (General Data Protection Regulation) and the very recent AI Act (Artificial Intelligence Act). Their interaction aims to reconcile technological innovation, protection of fundamental freedoms and digital security.

# 2. Common Objectives of the GDPR and the AI Act

The GDPR and the AI Act share a common objective: to guarantee a framework of trust for European citizens in the face of advanced digital technologies.

• The GDPR, which came into force in 2018, protects personal data and imposes strong principles: minimization, consent, transparency, security, rights of individuals…
• The AI Act, currently being adopted, aims to regulate AI systems according to a level of risk (unacceptable, high, limited, minimal). It imposes reinforced obligations for high-risk AI.

Together, they create a regulatory ecosystem that promotes ethical, reliable AI that complies with European values.

3. A Strategic Complementarity

The two texts are not in competition: they complement each other.

• The GDPR regulates the use of personal data.
• The AI Act regulates the use of AI systems themselves, whether or not they process personal data.

Thus, a predictive algorithm used in recruitment is simultaneously:

• subject to the GDPR (because it processes CVs, therefore personal data),
• and to the AI Act (because it can influence high-impact decisions).

The GDPR provides guarantees on the rights of individuals, the AI Act on the technical reliability and transparency of systems.

Good to know: the GDPR requires a DPIA (Data Protection Impact Assessment). The AI Act also requires a risk analysis for high-risk AI, incorporating biases, opacity, and potential harm.

# 4. The Differences in Scope between GDPR and AI Act The GDPR and the AI Act, while both European regulations, have distinct and complementary scopes. Understanding these differences is essential to ensure compliance with both frameworks. ## 4.1 GDPR: Focus on Personal Data The GDPR applies to: - Any processing of personal data - Organizations established in the EU or targeting EU residents - All sectors of activity without distinction Its primary objective is to protect the fundamental rights and freedoms of natural persons, particularly their right to privacy and the protection of their personal data. ## 4.2 AI Act: Focus on High-Risk AI Systems The AI Act specifically targets: - Artificial intelligence systems - Systems classified as high-risk or prohibited - Providers and deployers of AI systems in the EU Its main objective is to ensure the safety and conformity of AI systems with European fundamental values, going beyond the sole protection of personal data. ## 4.3 Complementarity of the Two Regulations The two texts overlap when an AI system processes personal data. In this case: - The GDPR governs data protection aspects - The AI Act regulates the safety and reliability of the AI system - Both regulations must be applied cumulatively This complementarity requires integrated governance that takes into account both frameworks in risk management and compliance.

Geographic Scope

• GDPR: applies to any processing of personal data, as soon as an European citizen is concerned.
• AI Act: applies to any AI system used, deployed or marketed in the EU, even if it is developed outside the EU.

Typology of Actors

• GDPR: targets data controllers, processors, DPO.
• AI Act: defines a complex chain of responsibility: provider, importer, distributor, deployer, authorized representative…

The GDPR is data-centric. The AI Act is technological product-centric.

5. Similarities in governance and compliance

Companies subject to both regulations will need to implement robust governance, with several common elements:

Note: many companies now assign AI Act governance to the DPO, highlighting the natural link between the two regulations.

6. Conclusion: Responsible AI at the Heart of Europe

The articulation between the GDPR and the AI Act constitutes a solid foundation for building trustworthy AI, in line with European values of respect for fundamental rights, transparency and ethics.

While these two regulations introduce high requirements, they also offer companies a competitive advantage, by enabling the deployment of reliable, responsible and user-respectful technologies.

For organizations, the challenge is clear: anticipate today the implementation of the GDPR and the future AI Act in their AI projects, by relying on data and cyber experts, and by strengthening their governance.