One AI agent can usually run under both UK GDPR and EU GDPR with a single core design, because principles, lawful bases, rights and the DPIA duty are largely shared. The practical differences sit in four places: automated decisions, international transfers, which regulator you answer to, and the EU AI Act, which applies in the EU and has no UK equivalent.
What do the two regimes share?
UK GDPR began as a copy of the EU's General Data Protection Regulation, adapted for the UK and read with the Data Protection Act 2018. For an agent, the shared core is substantial:
- the Article 5 principles: lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, security and accountability;
- the Article 6 lawful bases and the need for an extra condition for special category data;
- rights of access, rectification, erasure, restriction and objection;
- records of processing (Article 30) and data protection impact assessments (Article 35);
- controller-processor contracts, security duties and breach notification.
A firm that meets one regime well for an agent has done most of the work for the other. For the UK side in full, see what the UK GDPR regime requires of agents.
Who does each apply to?
EU GDPR applies to controllers and processors established in the EU, and to those outside it that offer goods or services to, or monitor, people in the EU. UK GDPR applies on the same logic to the UK. A firm with customers in both, or establishments in both, will often be subject to both for the same agent, sometimes for the same customer.
Where do they differ in practice for agents?
Automated decisions
This is the largest difference for agents. EU GDPR's Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects, allowing them only where necessary for a contract, authorised by law, or based on explicit consent, with safeguards. UK law in this area has been amended to widen the circumstances in which such decisions can be made, while keeping the safeguards and tighter limits for special category data; check which provisions are in force for you.
In practice: an agent that approves or declines on its own may have a lawful route in the UK that it lacks in the EU. Many firms design to the stricter EU position for both, so one configuration serves everyone. Others run a regional setting that holds EU decisions for human review. See UK GDPR Article 22 and agents for the UK detail.
International transfers
Prompts sent to a model provider outside the jurisdiction are transfers. The EU relies on its own adequacy decisions and standard contractual clauses. The UK has its own adequacy regulations and its own transfer tools, including an addendum that adapts the EU clauses. Transfers between the UK and EU themselves rest on mutual adequacy arrangements. For an agent, that means two sets of transfer documentation for the same model provider.
Regulators
In the UK, the ICO is the single regulator. In the EU, each member state has its own authority, and for cross-border processing a lead authority is usually set by where the controller's main EU establishment is. Guidance differs in emphasis, and you need to follow both the ICO's and the EU's.
The EU AI Act
The EU AI Act sits on top of EU GDPR for EU operations. High-risk agents bring deployer duties under Article 26, a fundamental rights impact assessment under Article 27 for certain deployers, and transparency duties under Article 50, such as telling people when they interact with an AI system. The UK has no AI Act; its regulators apply existing rules instead. For the wider comparison, see how AI rules differ between the UK and EU.
Take an illustrative case. A lender runs one collections agent for customers in the UK and Ireland. The core design is shared: same data minimisation, same retrieval scoping, same output checks, same retention. Differences are configured: in Ireland, any decision to refuse a payment arrangement is held for a person, because the firm does not rely on an EU Article 22 exception for it; in the UK, the firm documents its position under the amended rules but chooses the same hold for consistency. Transfer documents for the model provider exist in both UK and EU form. Irish customers are told they are interacting with an AI system, in line with Article 50.
How do you run one agent under both?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Shared principles | One design for minimisation, accuracy, security and retention | Common design record |
| Lawful basis | Basis recorded per capability per jurisdiction | Records of processing for each |
| Automated decisions | Regional setting for decisions that need human review | Configuration by region; review records |
| Transfers | UK and EU transfer mechanisms for each provider | Transfer documents for both |
| Regulators | Lead authority identified in the EU; ICO for the UK | Regulatory map |
| DPIA | One assessment with UK and EU sections | Combined DPIA |
| EU AI Act | Deployer duties, impact assessment and transparency for EU use | AI Act compliance file |
For the UK assessment, see a UK GDPR DPIA for agents.
What will regulators ask?
- Is this agent subject to UK GDPR, EU GDPR or both, and for which customers?
- How do you handle automated decisions differently, if at all?
- What transfer mechanisms cover your model provider in each regime?
- Which EU authority leads on your cross-border processing?
- How do you meet the EU AI Act for EU customers?
What does this comparison not cover?
It does not cover sector rules, which differ more sharply than data protection: the FCA and PRA in the UK, EU and national supervisors in the EU, and DORA for EU financial entities. Positions on both sides also evolve through guidance and case law. For the full map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Should a firm design to the stricter regime?
Often, yes, for a single agent serving both. It keeps one configuration and one set of evidence. Where the UK permits something the EU does not and the business value is high, a regional setting is the alternative.
Does an EU representative also cover the UK?
No. Firms outside each jurisdiction that are caught by its rules may need a separate representative in the UK and in the EU.
Is a DPIA under one regime accepted under the other?
The content largely overlaps, but each regulator assesses compliance with its own law. A combined DPIA with sections for each regime is the efficient approach.