What's the difference between the EU AI Act and GDPR?
GDPR is about personal data — names, emails, anything that identifies a person.
Drafted with AI help and checked against the official EU text before publishing.
GDPR is about personal data — names, emails, anything that identifies a person. The AI Act is about AI systems — how they are built and used. A shop can have duties under both at once. One does not replace the other.
Telling someone they are talking to AI is not the same as a GDPR privacy notice, and a privacy notice is not an AI-interaction notice. Article 2(7) of the AI Act says it does not affect GDPR. The two run side by side.
This is general information, not legal advice.
What the law actually says
"This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data."— GDPR, Article 1(1) (Regulation (EU) 2016/679) · eur-lex.europa.eu
"Union law on the protection of personal data, privacy and the confidentiality of communications applies to personal data processed in connection with the rights and obligations laid down in this Regulation. This Regulation shall not affect Regulation (EU) 2016/679 or (EU) 2018/1725, or Directive 2002/58/EC or (EU) 2016/680, without prejudice to Article 10(5) and Article 59 of this Regulation."— EU AI Act, Article 2(7) (Regulation (EU) 2024/1689) · eur-lex.europa.eu
In plain words
- GDPR (Regulation (EU) 2016/679) is data-protection law. If you put customer names into a chatbot, that processing still has to be lawful under GDPR.
- The AI Act (Regulation (EU) 2024/1689) is product-and-use law for AI systems: literacy, transparency, banned practices, and extra high-risk duties.
- Telling someone they are talking to AI (Article 50) is not the same as a GDPR privacy notice, and a privacy notice is not an AI-interaction notice.
- You can finish a GDPR record and still have AI-Act work to do, or the other way around.
- The AI Act settles the overlap itself, in Article 2(7): it does not affect GDPR. The two run side by side, and finishing one does not close the other.
- Will look for signs of AI use in the folders you choose, and write them down for you.
- Will write a plain-language readiness report. No evidence reads "Not assessed", never a green tick.
- Will run as a free Windows program on your own computer and send nothing from it.
- Coming with Guard: a check every month, kept so you can see your history and what changed since the last one.
- Coming with Guard: a printable readiness pack built from your check results — AI use found, training notes, disclosure checklist.
Did this answer your question?
Readiness guidance, not legal advice. The Free Toolkit sends nothing from your computer.