GDPR + EU AI Act for AI Applications: Double Obligation 2026

Main article: AI inventory in 8 steps — step by step: discovery, classification, provider/deployer mapping, GPAI marking and FRIA trigger.

1. How the GDPR and the EU AI Act mesh

Both legal acts apply in parallel and complement each other — but they attach to different triggers: the GDPR governs the processing of personal data, the AI Act (Regulation (EU) 2024/1689) governs the AI system and its risk class. The central points of contact are Art. 22 and Art. 35 GDPR on one side and Art. 14 and Art. 27 EU AI Act on the other.

An AI system is, under Art. 3 no. 1 AI Act, a machine-based system that is designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that infers, from the input it receives, how to generate outputs — such as predictions, content, recommendations or decisions — that can influence physical or virtual environments. The regulation follows a risk-based approach: the type and content of the rules are tailored to the intensity and scope of the risks (recital 26). This produces three tiers — prohibited practices (Art. 5), high-risk AI systems (Art. 6 et seq.) and AI systems with specific transparency obligations (Art. 50).

Independently of that, the GDPR examines two things: lawfulness via one of the six grounds in Art. 6(1) (consent, contract, legal obligation, vital interests, public interest, legitimate interest) and demonstrability via the accountability principle in Art. 5(2). Practical recommendation: carry out both assessments separately and assign each obligation to exactly one provision. A single measure can serve both sets of rules — but it does not replace either justification, and it does not count twice.

The following timeline states statutory application dates only.

2. DPIA + FRIA: who needs which assessment?

The DPIA applies to every controller where risk is likely to be high (Art. 35 GDPR); the FRIA applies only to public bodies, private providers of public services and deployers of high-risk AI under Annex III no. 5(b) and (c) (Art. 27(1) AI Act). The two have different triggers and must be kept cleanly apart. In detail: under Art. 35 GDPR, a DPIA is always mandatory where the processing — in particular where new technologies are used — is likely to result in a high risk to the rights and freedoms of natural persons.

Art. 35(3) GDPR names three standard cases in which it is required in particular: a systematic and extensive evaluation of personal aspects (profiling) producing legal effects, large-scale processing of special categories of data under Art. 9, and systematic large-scale monitoring of publicly accessible areas. The assessment must be carried out in advance, that is, before putting the application into service.

The FRIA (fundamental rights impact assessment), by contrast, is not mandatory for every high-risk AI system involving personal data. Under Art. 27(1) AI Act (Regulation (EU) 2024/1689) it applies only to:

• deployers that are bodies governed by public law or private entities providing public services, and
• deployers of high-risk AI systems under Annex III no. 5(b) (creditworthiness assessment and credit scoring of natural persons) and (c) (risk assessment and pricing in life and health insurance).

High-risk AI systems intended for use in the area of Annex III no. 2 (critical infrastructure) are expressly exempt from the FRIA.

Whether a high-risk AI system exists at all is decided by Art. 6 AI Act. Under Art. 113 AI Act as amended by Regulation (EU) 2026/1744 (in force since 27 July 2026), Chapter III Sections 1 to 3 — classification and the high-risk obligations, including the FRIA under Art. 27 — apply to Annex III systems from 2 December 2027 and to Annex I products under Art. 6(1) from 2 August 2028. Under Art. 6, the following applies: a system is considered high-risk if it is intended to be used as a safety component of a product covered by the Union harmonisation legislation in Annex I, or is itself such a product, and is subject to a third-party conformity assessment (paragraph 1); in addition, the systems listed in Annex III are considered high-risk (paragraph 2). Annex III lists eight areas: biometrics; critical infrastructure; education and vocational training; employment, workers management and access to self-employment; access to and enjoyment of essential private services and essential public services and benefits; law enforcement; migration, asylum and border control; administration of justice and democratic processes. By way of derogation, a system listed in Annex III is exceptionally not considered high-risk where it does not pose a significant risk to health, safety or fundamental rights (paragraph 3) — unless it performs profiling of natural persons.

Where both obligations coincide, both assessments are required — the FRIA does not replace the DPIA. Where an obligation under Art. 27 is already met through the DPIA carried out under Art. 35 GDPR, the deployer may cross-reference the relevant sections of that DPIA in the FRIA or include relevant parts of it (Art. 27(4) AI Act as amended by Regulation (EU) 2026/1744). A private company that uses high-risk AI in workers management (Annex III no. 4), for example, needs the DPIA — but no FRIA.

3. Art. 22 GDPR + Art. 14 EU AI Act

Art. 22 GDPR and Art. 14 EU AI Act meet at the AI-supported individual decision: both require human oversight and the possibility to intervene — one provision for the processing of personal data, the other for the AI system (see section 1). For score values the CJEU has made this concrete (judgment of 7 December 2023, C-634/21, SCHUFA Holding): an automated individual decision under Art. 22(1) GDPR already exists where a credit information agency automatically establishes a probability value, based on personal data, concerning a person's ability to meet payment commitments in the future, and whether a third party establishes, implements or terminates a contractual relationship with that person depends decisively on that value.

For implementation, two concrete tasks follow on the GDPR side. First, the legal basis: anyone using a score or another AI-supported evaluation needs a ground under Art. 6(1) GDPR. Where the processing relies on consent, the controller must be able to demonstrate that the data subject has consented; withdrawal is possible at any time and must be as easy as giving consent (Art. 7(1) and (3) GDPR). For public authorities there is the additional point that Art. 6(1)(f) (legitimate interest) is not available for the performance of their tasks.

Second, the response deadline: requests from data subjects under Art. 15 to 22 GDPR — including requests relating to an automated decision — must be answered without undue delay and in any event within one month of receipt (Art. 12(3) GDPR; on extension, see the FAQ). Practical recommendation: record in advance, for each AI application, who can supply the substantive reasoning behind an individual decision — the month runs from receipt of the request, not from internal clarification.

4. Special category data Art. 9 GDPR + Art. 4a EU AI Act

With sensitive data, two separate assessments apply: a processing prohibition with exceptions on the GDPR side and a prohibition of practices on the AI Act side. Special categories of personal data within the meaning of Art. 9 GDPR may exceptionally be processed where this is strictly necessary for bias detection and correction, and only subject to strict conditions; what those conditions are in detail is governed by Art. 4a AI Act, which replaced the former Art. 10(5) with Regulation (EU) 2026/1744.

GDPR side: Art. 9(1) prohibits the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, health data and data concerning a person's sex life or sexual orientation. Such processing becomes permissible only through an exception under Art. 9(2) — for example explicit consent. Its large-scale form is at the same time one of the standard cases for a DPIA (see section 2).

AI Act side: independently of data protection lawfulness, Art. 5(1) AI Act prohibits certain practices entirely. The ones most relevant for corporate use are emotion recognition in the workplace and in education institutions (point (f)), biometric categorisation to infer sensitive attributes (point (g)) and the untargeted scraping of facial images from the internet or from CCTV footage (point (e)). These prohibitions have applied since 2 February 2025 (Art. 113 AI Act). Outside the scope of the prohibition in Art. 5(1) — in particular for emotion recognition outside the workplace and education institutions — Art. 50(3) AI Act requires deployers to inform the persons concerned. Where a use is not already prohibited under Art. 5(1), the biometrics systems listed in Annex III no. 1 — remote identification, biometric categorisation according to sensitive attributes and emotion recognition — are also considered high-risk; the derogation in Art. 6(3) AI Act remains applicable alongside (see section 2).

5. Dual supervision

GDPR supervision and AI Act market surveillance have separate responsibilities — and are staffed differently depending on the jurisdiction. In an incident, the 72-hour notification under Art. 33 GDPR applies from a data protection perspective; whether a reporting channel on the AI Act side is also triggered depends on your role and the system class — clarify it before putting into service, not during the incident.

Germany: the Länder data protection supervisory authorities or the Federal Commissioner for Data Protection (BfDI) (for federal public bodies) for the GDPR — notification of a personal data breach under Art. 33 GDPR; the market surveillance authority for the AI Act has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), unless sectoral authorities — such as BaFin — are competent.
Austria: for the GDPR, the Austrian Data Protection Authority (Datenschutzbehörde, DSB, § 18 of the Austrian Data Protection Act (DSG)) is competent — the notification under Art. 33 GDPR goes to the DSB, not to the BfDI. Austria had not designated a market surveillance authority under Art. 70 AI Act as at the date of this article (17 August 2026); the AI service centre at RTR is an information and advisory body without supervisory powers. Check the state of designation as well as the single point of contact that must be made publicly available under Art. 70(2) AI Act before your first notification.

The legal starting point is Art. 51(1) GDPR: each Member State shall provide for one or more independent supervisory authorities. In Germany, the authorities competent under Land law supervise the application of data protection law in the non-public sector (§ 40(1) of the German Federal Data Protection Act (BDSG)); the BfDI is competent for federal public bodies and for certain providers of telecommunications services (§ 9(1) BDSG). In Austria, the Data Protection Authority is established under § 18(1) DSG as the national supervisory authority pursuant to Art. 51 GDPR; German supplementary provisions of the BDSG do not apply there.

On the AI Act side, each Member State establishes or designates at least one notifying authority and at least one market surveillance authority; these exercise their powers independently, impartially and without bias (Art. 70(1) AI Act). One market surveillance authority must be designated as the single point of contact, and the contact details had to be made publicly available by 2 August 2025 (Art. 70(2) AI Act) — that date has passed. In Germany, the single point of contact has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 6(1) KI-MIG); Austria had made no designation under Art. 70 AI Act as at the date of this article (17 August 2026).

For notification, Art. 33(1) GDPR applies from a data protection perspective: without undue delay and, where feasible, within 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; where the notification is made later, reasons for the delay must be given. Where the risk is likely to be high, communication to the data subject without undue delay under Art. 34(1) GDPR is added.

Both legal acts contain their own fine frameworks, each with its own trigger. The 4 % attach, under Art. 83(5) GDPR, to infringements of the processing principles, the conditions for consent and the rights of the data subject; the 7 % attach, under Art. 99(3) AI Act, to infringements of the prohibition of AI practices under Art. 5. The following overview states, for each row, the infringement to which the respective provision attaches.

The substantive obligations themselves — Art. 22, 35 and 9 GDPR as well as Art. 4a, 14, 26 and 27 EU AI Act — apply identically across the EU in both countries; as Regulation (EU) 2024/1689, the EU AI Act is directly applicable in the same way in Germany and Austria.

6. Practical implementation

Implementation runs along two separate strands of obligations with a shared filing system. In practice, a template that keeps the DPIA and the FRIA content catalogues in one document but sets them out separately (see section 2) has proven useful, as has one entry per AI application in the AI inventory that refers to the corresponding entry in the record of processing activities. Beyond the record of processing activities, the inventory entry captures three fields: the risk class under Art. 6 and Annex III AI Act, your own role as provider or deployer, and the reference to the DPIA or FRIA. Alongside this, an acceptable use policy governs which AI tools employees may use with which types of data, and staff training covers both legal acts.

These building blocks are practical recommendations — they do not follow from any single provision, they reduce duplicated effort and they do not replace individual evidence. The same applies to a separate contractual annex for AI providers (AI provider contract) alongside the processing agreement: it should cover the assurance of the provider documentation under Art. 53(1) AI Act, a duty to inform in the event of a model change, and a rule on the use of your inputs for training. The following table, by contrast, states statutory obligations only, with their sources.

The two transparency strands remain separate: the marking under Art. 50 AI Act comes in addition to the data protection information duties that follow directly from Art. 13 and Art. 14 GDPR. Anyone who meets only one of the two has not thereby discharged the other obligation.

A side effect is frequently overlooked. Germany: regardless of the number of employees, a data protection officer must be designated where processing operations are subject to a data protection impact assessment under Art. 35 GDPR (§ 38(1) BDSG); in addition, the threshold of as a rule at least 20 persons constantly engaged in the automated processing of personal data applies. An AI application subject to a DPIA can therefore trigger the designation obligation even in a small company. Austria: there is no numerical designation threshold going beyond Art. 37 GDPR; the designation obligation follows directly from Art. 37 GDPR, while § 5 DSG additionally governs confidentiality and — in the public sector — freedom from instructions.

Practical recommendation on procurement: when buying in a general-purpose AI model, request the documentation that the provider must keep available anyway under Art. 53(1) AI Act — technical documentation (at least Annex XI), information for downstream providers integrating the model (at least Annex XII), the copyright policy and the published summary of the training content. This documentation makes your own documentation towards supervisory authorities and customers easier.