Compliance with AI Act and GDPR

Main Requirements of the AI Act and GDPR

The Regulation divides AI applications into four categories:

• prohibited (unacceptable use, e.g., manipulative techniques, social scoring, etc.),
• high-risk (AI systems with a significant impact on safety or fundamental rights of individuals, e.g., in healthcare, transport, finance, education, or recruitment),
• limited risk (e.g., generative AI like ChatGPT – obligation of certain transparency measures, such as labeling AI-generated content)
• minimal or no risk (common AI applications not specifically covered by the AI Act)​.

High-risk AI systems will be subject to strict requirements – including certification and conformity assessment before being placed on the market, maintaining technical documentation, ensuring human oversight over their decision-making, measures for data quality and prevention of bias (discrimination), or system security​.

[⁠HIGHLIGHT title="2026 Update: When Rules for High-Risk AI Apply" text="<p>Regulation (EU) 2026/1744, which entered into force on 27 July 2026, postponed the requirements for high-risk AI systems. For systems under Annex III of the AI Act, such as recruitment, employee evaluation, or credit scoring, they will apply from 2 December 2027, and for AI as a safety component of products from 2 August 2028.</p><p></p><p>AI literacy now means that companies "take measures to promote the improvement of AI literacy" among their employees.</p><p></p><p>GDPR remains applicable without change, so you should perform Data Protection Impact Assessments (DPIAs) for AI tools involving personal data now.</p>"]

Providers of these systems must also expect registration in the EU database, continuous monitoring and updates, and they bear liability for potential damages​. Even for lower-risk AI, however, the AI Act establishes certain obligations – e.g., ensuring that users know they are interacting with AI (unless obvious) and labeling AI-generated content (so-called AI transparency)​.

Importantly, the AI Act impacts not only AI developers and providers, but to some extent also companies as users – if a business uses an AI system falling under the regulation, it must comply with the established rules for its use.

GDPR focuses on personal data protection and applies to all entities that process the personal data of EU citizens. For companies, this primarily means the obligation to process personal data lawfully and transparently – having a valid legal basis for each processing activity (consent, contract, legitimate interest, etc.), informing data subjects about the purpose and method of processing, and respecting their rights (e.g., the right of access to data, erasure, objection, or restriction of processing).

GDPR also requires the implementation of organizational and technical measures to secure data and minimize risks (encryption, pseudonymization, access restriction, etc.), and in the event of a security breach (data breach), it mandates reporting the incident to the authorities and often to the affected individuals as well.

Key to the field of AI is automated decision-making and profiling – GDPR (in Article 22) gives individuals the right not to be subject to a decision based solely on automated processing (including AI) if it has legal or similarly significant effects.

In other words, if a company uses AI for automated decision-making affecting individuals (e.g., client scoring, automated loan rejection, or screening job applicants), it must either obtain explicit consent or ensure that a human element enters the process, or provide the affected individuals with the opportunity to challenge the decision and have it reviewed by a human.

GDPR and AI overlap at moments when AI systems process personal data – at that point, it is necessary to comply with both regulations simultaneously. For example, the AI Act emphasizes respect for fundamental rights and explicitly requires the AI system's compliance with GDPR​, which means that data used for training or AI decision-making must be obtained and used within the limits of data protection law.

Practical Steps to Compliance

How specifically should a company proceed to meet the requirements of both the AI Act and GDPR? The key is proactivity and a systematic approach. Below we present practical steps and measures that medium and large enterprises should consider to achieve and maintain compliance:

Setting Up Internal Processes and Responsibilities

The first step is to establish AI governance within the organization – clear rules and processes for the development or use of artificial intelligence systems. Management should determine who will bear responsibility for the AI compliance agenda (for example, extending the scope of the existing Data Protection Officer – DPO – to the area of AI, or establishing a new role for AI ethics and compliance).

Furthermore, it is advisable to conduct an internal audit or inventory of all AI tools and projects that the company uses or develops, and evaluate their risk level from the perspective of both the AI Act and GDPR. This overview will make it possible to focus on the essential areas.

It is also necessary to update internal directives and policies – for example, adding rules for using generative AI (what employees are allowed or forbidden to input into tools like ChatGPT), defining the approval process for new AI solutions, and setting up procedures for reporting AI-related incidents.

Last but not least, this includes regular employee training – the AI Act introduces a requirement for so-called AI literacy, i.e., ensuring that staff handling AI have adequate knowledge of the rules and risks. Training should familiarize employees with the impacts of the AI Act and GDPR, with AI ethical principles, and teach them to recognize and resolve risky situations.

Identification of AI Systems Subject to Regulation

Not all AI tools in a company will fall into the high or limited risk categories under the AI Act. Therefore, it is necessary to categorize AI systems by risk levels.

Ask yourself: Are we using AI in an area designated by the AI Act as high-risk?

Typical examples for companies include: AI for recruitment and HR (CV screening, automated assessment of applicants), employee evaluation, as well as AI in financial services (client scoring, fraud detection), in healthcare (diagnostic algorithms), in manufacturing and maintenance (e.g., AI for critical infrastructure management), etc.

If a company develops its own AI-based product, it is an AI system provider – in which case it must also address potential certification and notification under the AI Act. Conversely, common uses of AI in marketing (e.g., e-shop recommendation algorithms), data analytics, or customer service (chatbots) will likely fall into the limited or minimal risk category.

It is advisable to assess each identified AI tool in terms of its purpose, type of processed data, and potential impacts. If it processes personal data, GDPR applies; if it falls under the definitions of the AI Act, note down which specific obligations will apply to it.

Dealing with High-Risk AI Applications

For AI systems that fall into the high-risk category under the AI Act, companies should implement special measures.

In practice, this means developing a detailed compliance plan for each such system. This includes conducting a conformity assessment – i.e., verifying that the system meets all technical and procedural requirements of the AI Act before its deployment. Many of these requirements will primarily have to be ensured by providers/developers (e.g., creating technical documentation, ensuring testing, and risk mitigation).

However, if a company procures a high-risk AI system from a third party, it is not off the hook – as a user, it has an obligation to verify that the system has the necessary certifications and meets legal requirements, and to use it only in accordance with the instructions and limitations specified by the provider. Companies should enter into contracts with AI suppliers covering compliance commitments to clarify who is responsible for what (similar to data processing agreements under GDPR).

Furthermore, it is necessary to establish human oversight over AI outputs – for decisions that have a significant impact on people (e.g., unsuccessful candidates or clients), there should be a process of human review or an option to appeal. Monitoring and testing of the AI system should not end with its deployment – high-risk AI requires continuous monitoring of performance, accuracy, and undesirable effects.

If an incident occurs (e.g., the AI fails and causes damage, or turns out not to meet the requirements), it is necessary to be able to report the issue to supervisory authorities (similar to reporting security breaches under GDPR). In short, high-risk AI systems should be subject to the same risk management regime as, for example, occupational safety or financial risks – with clear responsibilities, documentation, and controls.

Ensuring Transparency and Accountability of AI Systems

Whether it is a high-risk or lower-risk AI system, transparency towards users, clients, and employees is key. The company should be prepared to explain how the AI system works, at least in its basic features – especially for decision-making algorithms, it is good practice to have internally documented what data and criteria enter into the decision-making.

For external parties (e.g., customers), information should be available in an understandable format stating that the decision was made with the help of AI, along with a basic explanation of the logic upon request (of course, without disclosing trade secrets or protected know-how).

This transparency is a requirement of both the AI Act and GDPR – GDPR mandates informing data subjects about automated decision-making and the measures taken, while the AI Act goes further by requiring user documentation to be provided for certain systems and, where applicable, publishing information in the registry of high-risk systems.

A good step is to develop an AI code of ethics for the company, where management commits to the responsible use of AI (without discrimination, with respect for privacy, etc.), and to communicate this commitment publicly – this will strengthen the trust of both customers and employees.

Accountability also means being prepared to bear the consequences: if an AI system makes an error, the company should be able to react – investigate the incident, provide remedy to the affected individuals (e.g., compensation, the option to repeat the decision-making process in a different way), and adjust the system or process to prevent the situation from recurring.

In practice, we recommend establishing an AI commission or committee within the enterprise to oversee all major AI projects, approve them from a compliance and ethics perspective, and act as an advisory body in disputed situations.

Aligning AI Act Requirements with GDPR

Although the AI Act and GDPR are separate regulations, in practice they overlap and complement each other. It is beneficial for companies to approach compliance comprehensively – setting up a unified risk assessment process for AI projects that considers both privacy protection and impacts on fundamental rights.

GDPR already requires conducting a Data Protection Impact Assessment (DPIA) for risky processing; the AI Act adds to this a requirement for a fundamental rights impact assessment for high-risk AI systems.

These analyses can be combined – when planning the deployment of AI that will process personal data, the company will perform an extended risk analysis, evaluating both privacy risks (GDPR) and broader ethical and societal risks (AI Act). Information obtained from existing DPIAs can be used for the new assessment under the AI Act​, which avoids duplication and saves time.

Alignment also occurs at the level of technical measures – e.g., the AI Act's requirement for high-quality training data without bias complements the GDPR principle of data minimization and accuracy; the obligation to keep records of AI activity (logs) meets the GDPR obligation to document processing activities.

In the area of data subject rights, if AI processes personal data, the company must be able to comply with data subject requests under GDPR (to provide, correct, or erase their data) – therefore, already in the design phase of the AI system, it is necessary to think about so-called privacy by design and privacy by default.

A practical tip is to create a compliance matrix: GDPR requirements in one column, the AI Act in the other, and mark how each area is addressed internally. For example: “Informing data subjects – addressed within GDPR via privacy notices, while simultaneously meeting transparency under the AI Act”, etc. Such a matrix will help identify potential gaps as well as double compliance.

Let us also not forget that GDPR and the Czech Personal Data Processing Act apply to AI systems without exception. Unifying processes so that they fulfill both standards simultaneously is the most effective path to true compliance.

Practical Examples – Typical Mistakes and How to Avoid Them

Practical experience also shows that when implementing AI, companies often overlook certain obligations.

Here are four common mistakes to avoid:

Mistake 1: Sharing sensitive data with public AI tools.

It happens that employees enthusiastic about AI do not hesitate to input corporate or personal data into freely available services (e.g., using ChatGPT to generate a report from actual customer data). By doing so, however, they may unintentionally violate GDPR (if they transfer data to a third party without guarantees) and expose the company to the risk of know-how leakage.

How to avoid it? 

Set clear rules for using AI for employees. Explain what content is prohibited from being uploaded to external AI systems (e.g., personal data of clients, internal strategic documents) and why. Also consider technical measures that prevent sending sensitive data to the internet (filters, access restrictions). Educate employees that data entered into AI may be retained by the operator and may never return under the full control of the company.

Mistake 2: Automated decisions without the possibility of human intervention.

Some companies are attracted by the idea of fully automated decision-making (e.g., an AI system independently evaluating a loan application or a candidate's CV). However, if there is no possibility of human review, there is a risk of violating Article 22 of the GDPR as well as a risk of unfair or unverified AI outputs.

The remedy? 

For every AI decision-making process, introduce the “human in the loop” principle – set up a procedure where a disputed or negative AI decision is always confirmed by a human, or at least that the customer/applicant can challenge the decision and request a manual review. This will not only satisfy the legal framework but also increase the quality of outputs (AI can make mistakes or have biases). At the same time, regularly test the algorithm for bias – e.g., whether it discriminates against a certain group – and document the test results.

Mistake 3: Relying on suppliers without own verification.

For example, a company purchases AI software from a well-known manufacturer and assumes that its compliance is "covered". However, even when using external AI, the principle of user responsibility applies. If an AI tool causes harm to customers or employees, the company's reputation will suffer regardless of the fact that the technology came from outside.

Recommendation? 

Before implementing AI from a supplier, request information about their compliance – does the system have a certification or declaration of conformity with the AI Act? Has a privacy impact assessment been conducted? What guarantees does the contract provide regarding liability for errors? It is ideal to conduct your own audit of the delivered solution in a test environment – verifying how it handles data, what security features it has, and whether it performs the promised functions. In the contract with the supplier, include provisions on liability and indemnification in case their AI causes a violation of law or damage to third parties.

Mistake 4: Underestimating documentation and data subject consent.

When deploying AI that processes personal data, companies often forget to update their privacy policies and obtain the necessary consents. For example, a company starts using an AI analytical tool for detailed customer profiling but does not adjust the information provided to customers or the legal basis of processing accordingly.

How to do it right? 

Any new way of using personal data – including the deployment of AI – must be transparently communicated to data subjects. Therefore, before deploying AI, review your information obligations (policies, notices) and add a mention of the use of AI, including its purpose and logic.

Verify your legal basis: if the AI does something beyond the original purpose of data collection, you may need to obtain consent from the data subjects (e.g., for processing data for automated profiling). For more complex data use cases, consider consulting with a DPO or a lawyer, or potentially even a prior consultation with the Czech Office for Personal Data Protection, especially if the DPIA shows a high risk that cannot be fully mitigated.