AI Governance FAQ
How does AI governance relate to GDPR?
Quick answer
GDPR governs personal-data processing; the EU AI Act regulates specified AI practices, systems and actors. An AI use can fall under both. Assess their separate scopes and responsibilities, then reuse relevant evidence where possible. An AI Act classification does not determine whether GDPR applies.
Where GDPR and AI Act obligations overlap
GDPR Article 22 addresses decisions based solely on automated processing with legal or similarly significant effects. It includes defined exceptions and safeguards; it is not a ban on every AI-assisted decision. A DPIA is required where the processing is likely to create a high risk under GDPR, not automatically for every AI tool. Assess the legal basis, fairness, transparency and other data-protection requirements regardless of whether the system meets an AI Act high-risk definition.
Where the AI Act goes beyond GDPR
AI Act provider conformity assessment, deployer duties and an Article 27 fundamental-rights assessment have distinct purposes and scopes. They do not replace a DPIA. Where both impact assessments apply, relevant work can be cross-referenced while addressing each requirement. The Irish DPC remains the GDPR regulator; identify AI Act competence from the current statutory designation instead of assuming every personal-data system has the same authority for all purposes.
Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance. DPC Article 22 guidance.
Acuity AI helps Irish organisations manage EU AI Act compliance alongside their existing GDPR obligations. See our EU AI Act compliance services.