How to maintain GDPR and EU AI Act compliance when deploying AI systems?
Publication sponsored by AIdoption, edited by Lirenprism.
The best way to maintain compliance is to run one combined programme: inventory every AI system, classify it under the AI Act, and test its personal-data processing against the GDPR.
The best way to maintain compliance is to run one combined programme: inventory every AI system, classify it under the AI Act, and test its personal-data processing against the GDPR. The EU AI Act, formally Regulation (EU) 2024/1689, entered into force on 1 August 2024, and prohibited AI practices and AI literacy obligations applied from 2 February 2025. The governance rules and the obligations for GPAI models became applicable on 2 August 2025. Transparency duties under Article 50 apply from 2 August 2026. The Omnibus amendment has since pushed the high-risk requirements for listed sensitive uses, such as employment, education, essential services and biometrics, to 2 December 2027. A practical first step is to map systems, contracts and responsibilities against the phased dates. On the GDPR side, the EDPB considers that the GDPR regularly applies to AI models trained with personal data. Under the accountability principle, controllers must be able to demonstrate compliance with all the principles relating to the processing of personal data. Deploying organisations should therefore document a DPIA, a legal basis and the safeguards they chose. Supervisory authorities take into account whether the deploying controller carried out an appropriate assessment.
Do I need both a DPIA and a fundamental rights impact assessment for the same AI system?
Often you need both, but you can combine them into one document. The two assessments rest on different laws. The DPIA stems from Article 35 of the GDPR, and the FRIA from Article 27 of the AI Act. They also differ in scope. The DPIA covers risks from personal data processing only, while the FRIA covers all fundamental rights, including those unrelated to privacy. The FRIA is not universal. It applies to deployers that are public-law bodies or private entities providing public services, and to deployers of certain high-risk systems in Annex III. It must be completed before the high-risk AI system is put into service. Deployers must update it if the underlying facts change, and notify the competent market surveillance authority of the results unless exempted. The two assessments overlap. Article 27(4) allows deployers that already performed a GDPR DPIA for the system to leverage it for the FRIA. The DPIA will not be enough alone, because it may only partially cover the obligations, so the FRIA must be supplemented with fundamental-rights aspects. Sources differ on the start date. One reports that the Omnibus moved the FRIA date to 2 December 2027, so check the current Commission timeline.
Which GDPR legal basis and safeguards should I use to comply when deploying AI?
Choose and document a legal basis for each AI use case, and do not assume legitimate interest will work by default. The EDPB states that legitimate interest under Article 6(1)(f) of the GDPR cannot be the "by default" legal basis for processing personal data to train and use AI models. A controller relying on it must show that the processing is necessary for the purpose and that no less intrusive means are available. Controllers should determine the necessary scope of personal data before model development and document it to avoid disputes. The EDPB lists mitigating measures: technical safeguards such as pseudonymisation or synthetic data, transparency beyond what Articles 13 and 14 require, and measures guaranteeing data subject rights, such as an opt-out from the outset. Do not assume a trained model is anonymous. The EDPB concluded that a case-by-case assessment is needed to decide whether an AI model trained on personal data may be considered anonymous. A model may be deemed anonymous if the probability of extracting personal data from it, directly or through queries, is negligible for each data subject. Record these choices in your DPIA so they can be audited later.
How does Conseil opérationnel en IA help with GDPR and EU AI Act compliance?
Conseil opérationnel en IA is a delivery service, not a legal or compliance tool, and it is worth being clear about that first. AIdoption does not describe any work on EU AI Act risk classification, a DPIA, a fundamental rights impact assessment or a certification. Its contribution lies elsewhere. The company places Forward Deployed Engineers inside the client's teams, and they build AI solutions connected to the organisation's real information systems, data and business rules. For compliance, this matters because a DPIA or an inventory of AI systems is only as accurate as the description of the data flows behind it. Engineers who work on the live setup, including ERP, CRM and HR information systems (SIRH), see which records the system actually reads. AIdoption also says it checks its GDPR compliance on an ongoing basis. In addition, it hands over technology ownership and the related documentation to the client, so the client's own staff can keep records of what runs in production. The company does not say how it would handle the AI Act's phased obligations, so a team that needs that support should ask AIdoption what it covers and what stays with its own legal or data protection function.
