If an AI system touches personal data — in what it was trained on, in what people type into it, or in what it concludes about them — the GDPR already applies to it. Unlike most of the EU AI Act, that is not a future date. Here are the basics that matter for an AI system, and why Clause50 screens them beside the AI Act, from the same system record.
The GDPR in one paragraph
The General Data Protection Regulation (Regulation (EU) 2016/679) has applied since 25 May 2018 to any processing of personal data — information about a person who is identified or can be identified. It assigns roles: the controller decides why and how the data is processed and carries most of the duties; a processor acts on the controller's behalf, under a contract. National data protection authorities enforce it today, with fines of up to 20 million euros or 4% of worldwide annual turnover for the most serious infringements.
When an AI system is in scope
An AI system is in scope as soon as personal data passes through it: customer messages sent to a chatbot, CVs ranked by a screening tool, photos sent to an image model, or the predictions it makes about a person. Two points regularly catch AI teams out:
- Pseudonymised data is still personal data for anyone who can link it back to a person (Case C-413/23 P) — so removing names rarely takes a system out of scope.
- Commissioning can be enough to make you a controller. Whoever has an app built and decides what it is for is a controller even if they never touch the data themselves (Case C-683/21) — which matters for agencies and for the clients they build for.
The duties that matter most for an AI system
- A lawful basis for each purpose (Article 6) — including any use of personal data to train or improve the model, which is a purpose of its own.
- Extra conditions for special categories of data (Article 9) — health data, biometric data used to identify someone, and the other sensitive categories.
- Telling people (Articles 13 and 14) — what is processed and why and, where automated decisions are made, meaningful information about the logic involved.
- Limits on decisions based solely on automated processing (Article 22). A score can count as the decision when whoever decides draws strongly on it (Case C-634/21, SCHUFA) — so a scoring tool can be in Article 22 territory through its customers.
- A data protection impact assessment where processing is likely to result in a high risk (Article 35) — required in the cases the Article lists and on national authorities' lists, with the EDPB's criteria as the usual guide elsewhere.
- Terms with the AI service provider (Article 28), an entry in the record of processing activities (Article 30), and safeguards for transfers outside the EEA (Articles 44–46).
How it fits with the EU AI Act
The AI Act does not replace the GDPR; it sits on top of it, and the two meet in several places:
- Article 50(3): deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them, and process their personal data in accordance with the GDPR.
- Article 26(9): a deployer of a high-risk system uses the information the provider must give under Article 13 to carry out its data protection impact assessment.
- One notice: the AI disclosure Article 50 requires and the information Articles 13 and 14 require are read by the same person at the same moment, so they belong together.
Why Clause50 screens it beside the AI Act
- It is already in force. Most of the AI Act's high-risk duties bind from 2 December 2027; the GDPR binds now. For a team running a chatbot or a scoring tool today, it is the obligation that can already be enforced.
- It builds on the same facts. Recording an AI system for the AI Act already captures its purpose, its inputs, who it affects, the provider behind it and the human oversight around it — much of what a DPIA and a record of processing ask about. The GDPR screen adds its own questions on the same system record, so the facts live in one place instead of in a second questionnaire.
- The same standard of proof. The GDPR documents are built from your answers and evidence and signed exactly like the AI Act ones, so anyone you send them to can check they were not edited — without an account.
- Two scores, never merged. The AI Act and GDPR scores sit side by side; a strong file under one regime can never hide a weak file under the other.
Where Clause50 stops
Clause50 records and evidences; the controller decides. It does not conclude a data protection impact assessment, decide whether the authority must be consulted first (Article 36), choose a lawful basis or answer people's rights requests — and it never says a system is GDPR compliant. What Clause50 screens, and the documents it produces.
Key takeaways
- If personal data passes through your AI system, the GDPR applies to it today.
- For AI the duties that bite are the lawful basis, telling people, automated decisions, the DPIA, the processing record, vendor terms and transfers.
- Clause50 screens them from the same system record as the AI Act, with a separate score and signed documents — the decisions stay yours.