EU AI Act & GDPR

GDPR asks questions about personal data; the EU AI Act asks questions about AI systems. Both can apply to the same AI activity at once, and complying with one doesn't satisfy the other. Some AI Act obligations already apply: Article 4 on AI literacy since February 2025, the general-purpose AI obligations since 2 August 2025 and Article 50 transparency since 2 August 2026. After the Digital Omnibus, the Annex III high-risk rules apply from 2 December 2027 and Annex I from 2 August 2028.

Both frameworks converge on accountability: being able to show what your systems did and why. These articles separate the two laws, set out the timeline as it stands, describe the audit trail regulators and DPOs actually ask for, look at where System One models like Jev fit, and compare the governance platforms built for European requirements.