The AI Act for DPOs: where it meets the GDPR

Short answer: The AI Act and the GDPR are two separate regimes that often apply to AI systems at the same time. The GDPR protects personal data; the AI Act regulates AI systems regardless of whether they contain personal data. The DPO does not automatically own AI compliance, but is indispensable wherever AI processes personal data — which is almost always.

Two regimes, one system

The GDPR asks: do you process personal data lawfully, fairly and transparently? The AI Act asks: was this AI system placed on the market and deployed correctly, given its risk class? A recruitment AI falls under both: it processes personal data (GDPR) and is high-risk AI (AI Act).

The regimes reinforce each other but do not fully overlap. AI Act conformity does not guarantee GDPR compliance, and vice versa. The DPO must be able to keep those two tracks apart.

Where the GDPR and the AI Act meet

• DPIA. A data protection impact assessment is often mandatory for high-risk AI involving personal data. Align the DPIA with the risk assessment the AI Act requires; combine where possible, but keep them legally distinct.
• Legal basis. Training and using AI with personal data requires a valid GDPR ground. Legitimate interest or consent must be demonstrable.
• Automated decision-making. The GDPR gives data subjects rights regarding decisions without human involvement; the AI Act requires human oversight. Together they shape how an automated decision must be designed.
• Transparency. Both regimes require that people know that and how AI is used.

The limits of the DPO role

The DPO is an adviser and supervisor, not an implementer. AI Act compliance demands expertise beyond privacy: product safety, conformity assessment, technical documentation. Do not quietly assign those tasks to the DPO. The DPO guards the privacy share within a broader governance framework and works with the CISO, the product team and the board.

Protecting independence

A common mistake is having the DPO help build the AI system they must later assess. That undermines the independence the GDPR requires. Advise up front, but do not co-decide.

What to do

• Inventory which AI systems process personal data and what risk class they fall into — see high-risk obligations.
• Run DPIAs and link them to the AI Act risk assessment.
• Test the legal basis for training and deploying AI with personal data.
• Ensure transparency towards data subjects and human oversight for decisions.
• Protect your independence: advise, do not build.
• Invest in AI literacy within the privacy team.

The DPO is not the AI Act coordinator, but without the DPO no AI application involving personal data gets safely round the bend.