GDPR governs personal data by principle; the EU AI Act governs AI systems by risk. For an AI agent using customer data, they overlap on impact assessment, human involvement in decisions, transparency, data quality and records. They diverge on logs, bias testing with sensitive data, and who carries each duty. One set of controls can meet most of both.
What does each law require, in plain words?
GDPR applies whenever an agent processes personal data. Article 5 sets the principles: lawful, fair and transparent processing; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. Article 6 requires a lawful basis. Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects. Article 30 requires records of processing. Article 35 requires a data protection impact assessment where processing is likely to result in high risk.
The EU AI Act applies to AI systems by risk tier. For high-risk systems it requires risk management, data governance, logging, transparency to deployers, human oversight and accuracy from providers, and from deployers, use as instructed, oversight, monitoring, log retention and notices. Article 27 requires some deployers to assess fundamental rights impact. Article 50 requires people to be told when they interact with AI.
The roles differ too. GDPR asks who is controller and who is processor. The AI Act asks who is provider and who is deployer. A firm can be controller and deployer at once, and usually is.
Where do the duties overlap?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Impact assessment (GDPR Article 35, AI Act Article 27) | One assessment process with a data protection part and a fundamental rights part | Combined DPIA and FRIA, cross-referenced |
| Human involvement (GDPR Article 22, AI Act Article 14) | Named person approves decisions with significant effects before they take effect | Approval records with approver identity |
| Transparency (GDPR information duties, AI Act Article 50 and notices) | Disclosure that an AI agent is involved, what it does and how to reach a person | Notices and channel captures |
| Data quality (GDPR accuracy, AI Act Article 10 and deployer input data duty) | Agents read systems of record; facts carry their source; stale sources blocked | Source register; provenance in each record |
| Records (GDPR Article 30, AI Act logs) | Record of processing lists each agent; action record logs each event | Updated record of processing; retained logs |
| Security (GDPR integrity, AI Act Article 15) | Bounds on each capability; outside content cannot authorise actions | Bound settings; refusal records |
The first row saves the most work. The AI Act itself says that where a DPIA already meets some of the FRIA's requirements, the FRIA complements it. Running them as one process avoids two teams assessing the same agent from different angles.
The second row is where firms most often get the design wrong. Article 22 is about whether a decision is solely automated; Article 14 is about whether people can effectively oversee the system. A token sign-off fails both. A person who sees the evidence and can change the outcome meets both. Our piece on automated decisions under GDPR and where agents cross the line sets out the test.
Which duties are unique to each?
Only GDPR: lawful basis for every purpose; data subject rights such as access, rectification, erasure and objection; limits on international transfers; breach notification for personal data. These apply to every agent that touches personal data, whatever its AI Act tier.
Only the AI Act: prohibited practices; risk classification; conformity assessment for providers; AI literacy for all staff dealing with AI; serious incident reporting; Article 50 disclosure for systems that interact with people even where no personal data is used. These apply whether or not the agent processes personal data.
Most agents in regulated firms sit outside the AI Act's high-risk tier but squarely inside GDPR. For them, GDPR is the heavier law.
Where do the two pull in different directions?
Logs and storage limitation. The AI Act wants event logs kept for a period; GDPR wants personal data kept no longer than needed. The fix is tiered logs: a lean, pseudonymised event record kept longer, and raw content kept shorter.
Bias testing and sensitive data. The AI Act lets providers of high-risk systems process special category data where strictly necessary to detect and correct bias. GDPR restricts such processing heavily. Both apply, so the safeguards must satisfy both.
Explanation. The AI Act gives a right to an explanation of a high-risk system's role in a decision. GDPR requires meaningful information about the logic of solely automated decisions. They overlap but are not the same request; one response process should handle both.
What will a supervisor or auditor ask?
- Have you assessed this agent under both laws? Show us the combined assessment.
- Which decisions does the agent influence, and are any solely automated?
- What personal data is in your agent logs, and why that long?
- How did you test for bias, and with what data?
What does neither law settle?
Neither sets the limits on what an agent may do with money or records; that is for sector law and your own risk appetite. Neither resolves how other regimes fit, such as US state laws on automated decisions in Colorado's AI act or India's DPDP Act data fiduciary duties. For a single map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, the Pryme Context Protocol stamps every fact reaching an agent with its origin, which serves GDPR accuracy and the AI Act's data quality duty at once. Held verdicts put a named person in front of significant decisions, and the filed record serves both laws' accountability duties.
Questions people ask
Does GDPR apply to agents that do not make decisions?
Yes, whenever they process personal data. Reading a customer record, drafting a letter or summarising a call all count. Article 22 is the only part limited to decisions.
Can one team own both laws for AI agents?
It can coordinate both, but the expertise differs. Data protection and AI risk teams should run the combined assessment together, with one owner signing it off.
Which law should we start with?
Start with GDPR for any agent touching personal data, because it already applies in full. Then classify under the AI Act and add what the tier requires.