AI Act and GDPR, how they apply together and what the Digital Omnibus changed

Two laws with different subjects

The AI Act is a product safety law. It asks who places an AI system on the market or uses it, which risk level it falls into and which requirements it must meet. The GDPR is a data protection law. It asks who decides the purposes of the processing, on what legal basis and with what safeguards for the individual.

The roles do not necessarily coincide. The provider of an AI system may be its customer’s processor, and the deployer is usually the controller. But each role is decided with the criteria of its own law.

The coexistence rule in Article 2(7)

The Digital Omnibus on AI, Regulation (EU) 2026/1744, rewrote Article 2(7) of the AI Act. Union data protection law applies to personal data processed in connection with the AI Act. And the AI Act does not affect the GDPR, except as provided in its Articles 4a and 59. The latter governs data processing in regulatory sandboxes.

Sensitive data to detect bias, the new Article 4a

The GDPR in principle prohibits processing special categories of data, such as ethnic origin or health. The original AI Act allowed them to be processed to correct bias only by providers of high-risk systems, in Article 10(5). The Omnibus deleted that paragraph and replaced it with a broader Article 4a.

Providers of high-risk systems may exceptionally process such data where strictly necessary to detect and correct bias, if six conditions are met.

• That the objective cannot be achieved with synthetic or anonymised data
• That there are technical limits on its re-use and state-of-the-art security measures, including pseudonymisation
• That access is controlled, documented and limited to authorised persons under a duty of confidentiality
• That the data are not transmitted to or accessible by third parties
• That they are deleted once the bias is corrected or their retention period ends
• That the GDPR record of processing activities explains why it was strictly necessary

The novelty is in paragraph 2. On the same conditions, providers and deployers of other AI systems and models, and deployers of high-risk systems, may also do so. They must be addressing bias that could affect health, safety or fundamental rights, or lead to discrimination. The article makes clear that it creates no obligation to do so.

Two impact assessments that can share content

An AI system that processes personal data with high risk may need two different assessments. The GDPR one protects the data, and the AI Act one protects fundamental rights more broadly.

Article 26(9) of the AI Act requires the deployer of a high-risk system to use the provider’s information for its GDPR assessment. And the Omnibus rewrote Article 27(4), which now allows the fundamental rights assessment to include cross-references to the GDPR one, or the relevant parts of it. The AI Office must publish a model questionnaire, with an automated tool, that allows for that re-use.

The Article 27 assessment does not reach every company. A private company that uses AI to recruit needs the GDPR assessment, not the AI Act one.

Automated decisions, three layers of safeguards

When an AI system decides about a person, three rules with different scopes overlap.

• Article 22 GDPR restricts decisions based solely on automated processing that produce legal or similarly significant effects, and requires human intervention in the cases where they are allowed
• Article 26(11) of the AI Act requires the deployer of an Annex III high-risk system to inform people that they are subject to it
• Article 86 of the AI Act grants the right to obtain an explanation of a decision taken with those systems

The difference is one of scope. The GDPR protects against fully automated decisions. The AI Act also protects when a person decides with the help of the system. In employment, Spain adds a fourth layer, algorithmic transparency for workers, required by Royal Decree 723/2026.

Which authority supervises what in Spain

The Spanish Data Protection Agency (AEPD) remains the GDPR authority for any AI system that processes personal data. It showed this on 23 September 2026 with a warning to a company that was about to use AI to screen CVs, based solely on the GDPR. We explain it in our AI Act compliance guide for businesses.

For the AI Act, the Organic Law bill on the proper use and governance of artificial intelligence gave general supervision to the Spanish Agency for the Supervision of Artificial Intelligence (AESIA). It reserved to the AEPD the supervision of certain biometric practices and of migration and border control systems. The bill lapsed when the Spanish Parliament was dissolved in October 2026 and will have to be reintroduced. If it keeps that allocation, the same company may have two supervisors for the same system.

Example: a digital insurer

This case is fictitious. Segura Salud Digital, S.A. sells health insurance online from Bilbao. It wants to use an AI model from an external provider to set each customer’s premium from a health and lifestyle questionnaire.

Under the GDPR, it processes health data, so it needs an exception under Article 9 and an impact assessment under Article 35. Under the AI Act, the use falls under point 5(c) of Annex III, so it is high-risk. As deployer, from 2 December 2027 it will also have to carry out the fundamental rights assessment. And it will have to tell customers that the system plays a part in setting their premium.

If it finds that the model raises premiums for certain groups without justification, Article 4a allows it to process sensitive data to correct this. It will have to meet the six conditions. It will be able to re-use the relevant parts of the GDPR assessment in the AI Act one. The high-risk obligations are set out in our guide to high-risk AI systems.