EU AI Act vs GDPR: what builders actually need to know

If you build AI products for the EU market, you're now subject to two regimes. Here's the short version.

GDPR governs personal data

It applies whenever you process the personal data of people in the EU — training data, prompts, logs, outputs.

The AI Act governs AI systems by risk

It classifies systems as minimal, limited, high, or unacceptable risk, with obligations scaling accordingly.

Where they overlap

• Automated decisions: GDPR Art. 22 already restricts solely-automated decisions with legal effects; the AI Act adds transparency and oversight duties.
• Training data: using personal data to train still needs a GDPR legal basis, on top of AI Act data-governance rules.
• Transparency: both push you to tell users when and how AI is involved.

What to do now

Start with GDPR fundamentals (legal basis, minimisation, user rights), then layer AI Act obligations based on your risk tier. A compliance audit is a sensible first checkpoint.