Module 5 — AI Act and GDPR Together

Module 5 of the AI Act Compliance certification: DPIA and FRIA, GDPR Art. 22 and AI Act Art. 86, lawful basis, the Art. 10(5) special-category permission, and where the two regimes genuinely pull apart.

Every organisation deploying AI on personal data runs two regimes at once, and the commonest failures come from assuming one answers for the other. This module maps where they overlap, where they differ, and the two or three points where they genuinely pull in different directions.

The relationship, stated once

The AI Act is product-safety legislation. It asks whether a system may be placed on the market and used, and it regulates the system through its lifecycle.

The GDPR is data protection law. It asks whether processing personal data is lawful, fair and transparent, and it regulates the processing.

The AI Act is without prejudice to Union data protection law. Both apply. Neither displaces the other, and neither is lex specialis to the other in any general sense.

Practically: an AI system can be entirely compliant with the AI Act and unlawful under the GDPR, and vice versa. The two files share evidence; they do not share conclusions.

DPIA and FRIA

Three practical points.

Most private organisations owe a DPIA and not a FRIA. A private employer deploying Annex III point 4 recruitment screening owes a DPIA if the threshold is met, and no FRIA. Writing that determination down once is worth a quarter of avoided work.

Where both are owed, they complement. Art. 27 provides that where any of the obligations are already met through the DPIA, the FRIA complements it. Share the evidence base; keep the documents distinct, because they answer different questions and a merged document usually answers neither well.

AI Act Art. 26(9) makes the provider's Art. 13 information feed the DPIA. That is the practical link: the accuracy figures, limitations and oversight measures the provider must supply are inputs to your data protection assessment.

Art. 22 GDPR and Art. 86 AI Act

These are frequently confused and they are not close.

GDPR Art. 22 applies to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the data subject. Such decisions are prohibited unless one of three grounds applies — necessity for a contract, authorisation by Union or Member State law, or explicit consent — and where the contract or consent grounds apply, safeguards must include the right to obtain human intervention, to express one's point of view, and to contest the decision.

AI Act Art. 86 applies to a decision taken by a deployer on the basis of the output of a high-risk Annex III system, producing legal effects or similarly significantly affecting the person in a way they consider adversely impacts health, safety or fundamental rights. It gives the right to obtain clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision.

The key operational difference: inserting a meaningful human decision-maker removes a decision from Art. 22, and does not remove it from Art. 86 or from Art. 26(11), both of which cover systems that assist in decisions.

Build one response procedure that satisfies the stricter of the two on each element, with a single intake, a named owner and a clock. Two procedures produce inconsistent answers to the same person.

Lawful basis, and the AI Act's silence

The AI Act says nothing about lawful basis. It does not create one, and complying with it does not make processing lawful.

Three areas where this bites:

Training data. Assembling a training set from personal data needs a GDPR basis. The AI Act's Art. 10 governance requirements assume the data is lawfully held; they do not make it so.

Bias testing. Art. 10(5) permits providers to process special categories of personal data exceptionally, to the extent strictly necessary for bias detection and correction, subject to conditions — necessity, technical re-use limits, pseudonymisation and state-of-the-art security, documented access control, no transfer to third parties, deletion once corrected. This is one of the few places the AI Act speaks directly into GDPR territory, and it is narrow. It applies to providers, for bias detection and correction, and nothing else. The Digital Omnibus adjusted its framing in July 2026, so positions written earlier need re-checking.

Logs. Art. 26(6) requires deployers to keep automatically generated logs for at least six months. Those logs frequently contain personal data. The AI Act creates the retention requirement; the GDPR governs the processing, and "the AI Act made me" is a legal obligation basis for the retention itself but not a licence to use the logs for anything else.

Where the regimes genuinely pull apart

Minimisation versus evidence. The GDPR pushes toward collecting less and deleting sooner. The AI Act pushes toward retaining logs, evidencing representativeness, and holding files for ten years. Both are right within their own frame, and the resolution is purpose limitation: retain what the AI Act requires, for the purpose it requires it, and do not repurpose it.

Explainability versus trade secrets. Art. 86 requires clear and meaningful explanation of the role of the system. Art. 53(1)(b) and Annex XII expressly protect IP and trade secrets on the model side. The reconciliation is that Art. 86 asks about the role of the system in the decision procedure and the main elements of the decision, not about model internals.

Automated decision prohibition versus mandated human oversight. These actually align: Art. 14's oversight requirements and Art. 22's human intervention safeguard push the same way. The trap is assuming that satisfying Art. 14 satisfies Art. 22 — Art. 14 is about the system permitting oversight, Art. 22 is about the individual's right to obtain human intervention on their case.

The joint file

Practically, hold one evidence base and two conclusions:

• Shared: the system description, the intended purpose, the categories of persons affected, the data used, the accuracy and limitation figures from Art. 13, the oversight arrangements.
• GDPR-side: lawful basis, necessity and proportionality, data subject rights procedures, retention, the record of processing entry, transfers.
• AI Act-side: classification determination, Art. 26 artefacts, Art. 50 notices, FRIA determination — including the negative — and the literacy register.

Check yourself

1. We did a DPIA, so the FRIA is covered. — Different questions. And most private organisations do not owe a FRIA at all; record why.
2. A human approves each decision, so Art. 86 does not apply. — Art. 86 and Art. 26(11) cover systems that assist in decisions. Human involvement may take you outside GDPR Art. 22; it does not take you outside these.
3. We rely on Art. 10(5) to keep a demographic-labelled dataset for future fairness work. — The permission is strictly for bias detection and correction, with deletion once corrected. It is not a general licence.
4. Complying with the AI Act makes our training data lawful. — The AI Act creates no lawful basis. Art. 10 assumes lawful holding; it does not confer it.

Previous: Module 4 — Governance gates Next: Module 6 — Incidents, complaints, whistleblowing →