EU AI Act vs GDPR

The EU AI Act and GDPR are not rivals, and a business does not choose between them. GDPR protects personal data and applies whenever you handle information about an identifiable person. The EU AI Act regulates AI systems and applies according to what an AI system is used for. A business that uses AI on information about customers or staff is covered by both, and most small businesses are.

This comparison explains what each law covers, how they differ and where they overlap. It also covers whether the AI Act applies to small businesses, what the fines look like, what changed with the delay to the deadlines, and what to do first. It is a plain-English guide and not legal advice.

Key takeaways

• GDPR is about personal data. The EU AI Act is about AI systems. Using AI on personal data brings in both.
• The EU AI Act applies by use case and not by company size. A small business using AI for a high-risk purpose carries the same core obligations as a large one.
• Most everyday AI use, such as drafting and summarising, sits outside the high-risk category. Recruitment and candidate screening sit inside it.
• The vendor does not carry everything. A business that deploys a tool keeps its own oversight duties, and the AI literacy duty has applied since 2 February 2025.
• The Digital Omnibus moved the main high-risk deadline for stand-alone systems from 2 August 2026 to 2 December 2027. It is a delay and not a removal.
• The fines are ceilings. The AI Act’s top tier is higher than GDPR’s, but most business duties sit in lower tiers.

What is the EU AI Act?

The EU AI Act is the European Union’s regulation on artificial intelligence, published as Regulation (EU) 2024/1689. It sorts AI systems by the risk they carry. A few uses are banned outright. A larger group is classed as high-risk and faces documentation, oversight and risk management duties. Systems that interact with people carry transparency duties, and most everyday tools sit in a minimal-risk group with few obligations.

The idea to hold on to is that obligations follow risk. The Act does not care how big your company is or whether the software runs on your own server or behind an API. It cares what the system does. A tool that drafts a social post and a tool that ranks job applicants are very different things under the Act, even if both are a chat window in a browser.

What is GDPR?

GDPR, the General Data Protection Regulation, is Regulation (EU) 2016/679. It has applied since 2018 and covers any processing of personal data about people in the EU. Personal data means anything that can identify a person, directly or in combination with other details, such as a name, an email address, an order history or a job title in a small town.

GDPR does not mention AI as a special case. It does not need to. If a staff member pastes a customer email into an AI tool, that is processing of personal data, and your business needs a lawful basis for it, a contract with the provider where one is required, and a reason to hold only the data the task needs. Our guide on what is safe to paste turns that into a rule your team can follow.

What is the difference between the EU AI Act and GDPR?

The short answer is that they regulate different things from different angles. GDPR regulates data and the Act regulates systems. The table sets out the main differences.

Two differences matter most in practice. First, the AI Act can apply when no personal data is involved, for example an AI system that sorts machine sensor readings in a factory. Second, GDPR can apply when no AI is involved, for example a paper filing system. The overlap sits in the middle, where AI is used on information about people.

Does the EU AI Act apply to Small Businesses?

Yes. The Act draws its line at the use and not at headcount or turnover. A small business using AI for a purpose the Act treats as high-risk carries the same core obligations as a large business using it for the same purpose. Small size is not an exemption.

Most small business use will not be high-risk. Drafting emails, summarising meetings, producing first drafts of marketing copy and answering internal questions all sit comfortably outside it. The difficulty is that you cannot know which uses are which without classifying them. That is the job of a risk classification: list the AI uses in your business, then place each one against the Act’s tiers.

The clearest example for small businesses is hiring. The Act treats AI used in recruitment and candidate evaluation as high-risk, including CV filtering and job-advert targeting, and the same applies to AI that decides promotion, termination or task allocation. If you use an AI tool to rank applicants, you are in the high-risk group whichever product you use, and you should take advice before continuing.

There is also a duty that applies to almost everyone. Since 2 February 2025, the Act has required organisations that provide or use AI systems to take steps to ensure their staff have a sufficient level of AI literacy. For a small business, that does not mean a course for everyone on day one. It means making sure the people using AI at work understand what it is, what it gets wrong, and what must never be pasted into it.

Do you need to comply with both?

If you use AI on information about people, you need to meet both. They are not alternatives and neither one replaces the other.

Take a support team that uses an AI assistant to draft replies. GDPR asks whether the customer’s personal data may go into that tool, under what contract, and whether you need all of it. The AI Act asks what the system is used for, what risk it carries, whether a person oversees the output, and whether your staff understand the tool. One use, two sets of questions.

The practical advice is to check both at the same point, when a use is first proposed, and not to run them as separate projects. A short written record per AI use, saying what the tool does, what data goes in, which account type is used, who reviews the output and what the risk tier is, answers most of both laws’ first questions in one page. That is the basis of AI governance for a small business, and our guide on AI governance for small and mid-sized businesses sets out how to build it without a compliance department.

A caution on vendors. A business that buys a tool does not buy its way out of responsibility. Under the Act, the heaviest obligations for a high-risk system generally sit with the provider that built it. A deployer, meaning the business that uses the tool, still carries oversight duties of its own. Under GDPR the business remains responsible for the personal data it chooses to put in. “The vendor handles compliance” is not a defensible answer under either law.

What are the fines under the EU AI Act and GDPR?

Both laws set fines as ceilings, calculated as a fixed sum or a percentage of worldwide annual turnover, whichever is higher for a company.

Under the AI Act, Article 99 sets three main tiers. Breaches of the banned practices carry fines of up to 35 million euro or 7% of turnover. Most other operator duties, including those of providers and deployers, carry up to 15 million euro or 3%. Supplying incorrect or misleading information to authorities carries up to 7.5 million euro or 1%.

Under GDPR, Article 83 sets two tiers. The upper tier, which covers the core principles, individuals’ rights and international transfers, allows up to 20 million euro or 4% of turnover. A lower tier covers other obligations, such as record keeping and security measures, at up to 10 million euro or 2%.

Read these as ceilings and not as typical outcomes. Regulators weigh the seriousness of the breach, how long it lasted, the size of the business and what it did to put things right. For a small business the more realistic risks are an order to stop using a tool, a complaint from a customer, or the loss of a client who asks for evidence of how you handle their data. What the fines show is how seriously each law is meant to be taken. The rules on how they apply to a particular business belong with a qualified lawyer.

Has the EU AI Act deadline been delayed?

Partly. The Digital Omnibus on AI was formally adopted in 2026 and is now in force as Regulation (EU) 2026/1744. It moved the date for stand-alone high-risk systems under Annex III, which includes employment and recruitment uses, from 2 August 2026 to 2 December 2027. It moved the date for high-risk AI embedded in regulated products under Annex I, such as machinery or medical devices, from 2 August 2027 to 2 August 2028.

Several things did not move. The banned practices and the AI literacy duty have applied since 2 February 2025. The Omnibus left the transparency obligations in Article 50 and the rules for general-purpose AI models on their earlier schedule, although generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement for AI-generated content. Commentators also stress that the delay changes when duties bite, and not what is classed as high-risk.

The sensible reading is that you have more time to prepare for high-risk obligations, not permission to ignore them. Dates have moved before and may move again, so confirm the current position with your own adviser before relying on any one of them.

What does this mean when staff use ChatGPT?

Most small businesses meet both laws through everyday assistants, so this is where the comparison becomes practical. Take ChatGPT as the example, since it is the tool most teams start with.

Under GDPR, the question is what goes in. A customer’s name and complaint pasted into a personal account is personal data sent to a provider your business has no agreement with. Pasting the same text, stripped of names, into an approved business account is a very different thing. The three-tier test in our paste guide, green, amber and red, applies the principle in five seconds.

Under the AI Act, the question is what the tool is used for. Drafting a reply that a person reads before sending is a minimal-risk use. Using the same tool to score or rank job applicants is a high-risk use, even though the software has not changed. The tool is not the unit of classification. The use is.

Two more points connect the laws. Staff who use unapproved accounts create shadow AI, which hides exactly the information both laws need you to know: what tools are in use and what goes into them. And because assistants can produce hallucinations, a person must check anything that reaches a customer or feeds a decision about someone. That human check is a practical safeguard under the Act’s oversight ideas and under GDPR’s rules on automated decisions about individuals.

What should a Small Business do first?

You do not need a legal project to start. A sensible first month looks like this.

1. List every AI tool in use, including the ones nobody approved, and note which account type sits behind each.
2. Classify each use. Mark it minimal, needs care, or possibly high-risk. Anything touching hiring, promotion, credit or other decisions about people goes on the list for advice.
3. Write one page of rules. Which tools are approved, what may be pasted, who reviews output, and who to ask when unsure.
4. Cover AI literacy. A short session on real examples from your team’s work meets the spirit of the duty better than a long document nobody reads.
5. Keep a record. One line per use with the tool, the data, the risk tier and the owner. It answers most of the questions a customer or regulator would ask.
6. Take advice on the high-risk cases. This guide is not legal advice, and a qualified lawyer should confirm the classification of anything borderline.

If you want an outside view on which tools your staff use and which obligations each carries, an AI audit maps both laws against your actual use and gives you the list, the classification and a checklist in one pass. An audit is a diagnostic and not a legal opinion, so it identifies the obligations without certifying them.

Sources

• Regulation (EU) 2024/1689, the EU AI Act: the text of the Act, including the risk tiers, the high-risk categories, the AI literacy duty and the banned practices.
• Regulation (EU) 2016/679, GDPR: the text of GDPR, including Article 83 on administrative fines.
• European Commission AI Act Service Desk, Article 99: the penalty tiers of up to 35 million euro or 7%, 15 million euro or 3%, and 7.5 million euro or 1%.
• Gibson Dunn, EU AI Act omnibus agreement: the postponed high-risk deadlines under the Digital Omnibus.
• Orrick, EU AI Act update, Digital Omnibus finalises changes (July 2026): the adoption and entry into force of the Omnibus, and the dates that did not move.