The AI Act and the GDPR: the duties that arrive together

Both rulebooks apply to the same AI use

The AI Act applies without prejudice to the GDPR. Neither replaces the other. If your AI touches personal data — customers, staff or applicants — both are live on the same facts.

For a small business the GDPR is usually where most of the work sits. It has applied since 2018, and it reaches the deployer — the role you hold when you buy a tool rather than build one.

The six GDPR duties an AI use triggers

A lawful basis for each purpose, not for each tool. Legitimate interests covers many internal uses, but the balancing has to be written down.

A privacy notice that names the AI uses. A notice written before the tools arrived almost never covers them, and staff are usually on a separate notice nobody has updated.

A processor contract with each AI vendor.

A transfer mechanism for each vendor outside the EEA.

Records of processing that include the AI uses. The under-250-staff exemption falls away where processing is not occasional, and payroll is not occasional.

Security measures, and a breach reported to your authority within 72 hours.

Where it catches people

The vendor training setting. A vendor that trains on your inputs for its own purposes is not your processor for that training. It is a controller, your contract does not cover it, and your notice needs to change.

The two regimes do not price mistakes the same way. Article 99(6) caps an SME at the lower of the fixed sum or the percentage. The GDPR has no equivalent reversal, so the same turnover can carry very different exposure under each.