Skip to content
Clause50EU AI Act evidence — starting with Article 50.EU AI Act evidence, starting with Article 50
Sign in

GDPR for AI systems — the duties your AI system already owes, evidenced.

If your AI system processes personal data, the GDPR applies to it now. Clause50 screens the same system record you keep for the EU AI Act against the GDPR duties that bite hardest on AI — the data protection impact assessment, automated decisions, what people must be told, the record of processing, transfers — and builds the documents from your answers and evidence.

Screen a system — free →Everything Clause50 covers →
Why it belongs beside the AI Act
Already enforcedThe GDPR has applied since 25 May 2018. If your AI system processes personal data — in training, in its inputs or in what it infers — these duties bind it today, not in 2027.
One system record, two regimesThe GDPR screen sits on the same system record you keep for the AI Act, on its own tab with its own questions. Evidence you record once can answer both.
Free to screenAnyone may answer the GDPR questions and read the result. A plan decides one thing: whether the signed documents leave.
Beyond the AI Act

GDPR duties for AI systems — the same record, a separate score

An AI system that processes personal data owes GDPR duties that are already enforced. The same system record is screened against a second, separately versioned rule pack for them, on its own tab. The two scores are never merged: a strong GDPR file cannot hide a weak AI Act file, or the other way round.

15 GDPR obligations modelled, all in force today. Rule pack gdpr-ai 2026.02.

GDPR — screened per system, scored separately
  • GDPR Art. 6Lawful basis for each purpose, including trainingin force
  • GDPR Art. 9Special categories of personal datain force
  • GDPR Art. 13-14Information to people whose data the AI system processesin force
  • GDPR Art. 22Decisions based solely on automated processingin force
  • GDPR Art. 22 · screeningAutomated-decision determination reviewedin force
  • GDPR Art. 25Data protection by design and by defaultin force
  • GDPR Art. 28Terms with the AI service provider — processor or otherwisein force
  • GDPR Art. 30Record of processing activities — this AI system's entryin force
  • GDPR Art. 35 · screeningDPIA screening reviewedin force
  • GDPR Art. 35(1)DPIA — systematic description of the processingin force
  • GDPR Art. 35(2)DPIA — advice, sign-off and reviewin force
  • GDPR Art. 35(7)(b)DPIA — necessity and proportionalityin force
  • GDPR Art. 35(7)(c)DPIA — risks to the rights and freedoms of peoplein force
  • GDPR Art. 35(7)(d)DPIA — measures to address the risksin force
  • GDPR Art. 44-46Transfers of personal data outside the EEAin force

The documents it produces

Built from your answers and evidence, signed and verifiable like every Clause50 document. Screening and coverage are free to read; a plan decides whether the signed copy leaves.

  • GDPR Article 22 Automated-Decision Determination (AI system)
  • GDPR Data Protection Impact Assessment Dossier (AI system)
  • GDPR DPIA Screening Record (AI system)
  • GDPR Article 30 — AI System Entry Check (from information recorded in Clause50)
  • AI Transparency and Privacy Notice (AI Act Art. 50 + GDPR Arts 13/14)

What stays yours under the GDPR

  • Concluding the data protection impact assessment — the controller does (Article 35(1)), with the DPO’s advice where one is designated. The dossier is evidence toward it.
  • Deciding whether the authority must be consulted first (Article 36). Clause50 never concludes it.
  • Choosing the lawful basis for each purpose. Clause50 records the one you name; it does not pick it.
  • Answering people’s rights requests and notifying a personal data breach.
  • Reading a screening result: “not indicated by the answers recorded” is not “not required” — national lists and context can still require a DPIA.
  • Clause50 never states that a system is GDPR compliant.

Which plans include it

GDPR for AI systems is included on every paid plan — including both single-system packs — for every AI system the plan covers. There is no separate GDPR allowance and no add-on, unlike high-risk technical files. Screening and both scores are free on every plan, including Free; GDPR duties arise only where a system processes personal data, and the screen shows which apply. See the plans →

See where your AI system stands under both.

Record a system once. The AI Act and GDPR scores sit side by side, never merged.

Screen a system — free →

Our reading of the GDPR in this rule pack is not yet reviewed by counsel. Clause50 is an evidence platform, not legal advice.