The GDPR governs how personal data is collected, processed, stored, shared, and protected. The AI Act governs how AI systems use data, especially in high-risk contexts, and adds requirements for transparency, oversight, and system governance. Enterprises need both frameworks working together because privacy controls alone do not address AI risk, and AI controls alone do not satisfy data protection obligations.
Why This Matters for Security Teams
The AI Act and GDPR solve different governance problems, and enterprise teams get into trouble when they assume one framework can stand in for the other. GDPR is about lawful personal data processing, data subject rights, minimisation, retention, and cross-border handling. The AI Act is about the safety, transparency, oversight, and lifecycle governance of AI systems, especially where risk to people is higher. That distinction matters when models are trained on sensitive records, when outputs affect decisions, or when an AI feature is embedded into a regulated workflow.
In practice, the gap shows up in controls: privacy teams may sign off on collection and retention, while model owners still lack documented oversight, logging, human review, or post-deployment monitoring. Conversely, ai governance can be technically sound and still fail privacy law if the data foundation is weak. NHI Management Group’s guidance on Ultimate Guide to NHIs — Regulatory and Audit Perspectives is a useful reminder that auditability is not the same thing as compliance, and both matter. Current guidance suggests treating the two regimes as complementary layers, not competing ones. In practice, many security teams discover this only after an AI use case is already in production and the first compliance review exposes missing owner, purpose, or retention controls.
How It Works in Practice
Enterprise AI governance usually needs a split-control model. GDPR defines the rules for personal data: lawful basis, transparency, purpose limitation, data minimisation, access rights, and processor accountability. The AI Act adds obligations around how the AI system behaves: risk classification, technical documentation, human oversight, logging, accuracy, robustness, and transparency to users where required. For high-risk systems, governance must extend beyond the dataset into the model, application, and operating process.
A practical operating model often starts with three questions: Is personal data involved? Does the AI system make or influence consequential decisions? Is the use case in a high-risk category or otherwise sensitive? If the answer to any of these is yes, controls need to be mapped in parallel. Privacy impact assessment and AI risk assessment should not be separate silos. They should share inventory, owners, data lineage, and escalation paths.
- Use GDPR to govern collection, legal basis, retention, deletion, sharing, and individual rights handling.
- Use the AI Act to govern model purpose, risk class, transparency, oversight, and post-deployment monitoring.
- Track training data, prompts, outputs, and downstream use cases so audit teams can trace both privacy and AI decisions.
- Require human review where AI output can materially affect people, especially in employment, credit, healthcare, or access decisions.
For teams building the control stack, NIST AI Risk Management Framework is useful for structuring govern, map, measure, and manage activities, while the EU’s EU AI Act clarifies where legal obligations attach. If personal data and AI outputs are tightly coupled, the governance team should also align with GDPR guidance and document which control answers which requirement. The State of Secrets in AppSec notes that 43% of security professionals are concerned AI systems could learn and reproduce sensitive information patterns from codebases, which is one reason privacy and AI risk reviews cannot be treated as separate rituals. These controls tend to break down when models are embedded in fast-moving product teams with no single owner for data, model, and business outcome.
Common Variations and Edge Cases
Tighter governance often increases delivery overhead, so organisations have to balance speed against evidentiary quality. That tradeoff becomes visible in edge cases where the legal answer and the AI answer are not identical.
One common variation is an AI system that never stores personal data but still processes it transiently. GDPR obligations may still apply, but the AI Act questions shift toward transparency, safety, and oversight. Another case is vendor-hosted AI: the enterprise may be a controller under GDPR, while the provider carries AI Act obligations for the system. Responsibility still needs to be contractually clear, because accountability does not disappear just because the model is external.
Best practice is evolving for general-purpose AI and embedded copilots. Some uses may not be high-risk under the AI Act, yet they can still create privacy, confidentiality, or discrimination issues under GDPR and internal policy. That is why NHI Management Group recommends pairing inventory discipline with governance review, and using Top 10 NHI Issues alongside AI and privacy assessments when models rely on service accounts, API keys, or autonomous workflows. There is no universal standard for this yet, especially where AI features continuously retrain, re-rank, or personalise behaviour. The practical answer is to assign one owner for each control domain and force cross-review before launch, not after complaint or regulator inquiry.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack surface, NIST AI RMF, NIST CSF 2.0 and NIST SP 800-63 set the technical controls, and EU AI Act define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| EU AI Act | Defines governance duties for AI systems, especially transparency and oversight. | |
| NIST AI RMF | Provides a governance structure for managing AI risk across the lifecycle. | |
| NIST CSF 2.0 | GV.RM | Risk management governance helps connect privacy and AI control ownership. |
| NIST SP 800-63 | SP 800-63-3 | Identity assurance matters when AI systems trigger sensitive actions or access. |
| OWASP Agentic AI Top 10 | Agentic systems add autonomous behavior that changes governance and oversight needs. |
Classify the AI use case, document risks, and implement required oversight and logging controls.
Related resources from NHI Mgmt Group
- What is the difference between attack surface management and NHI governance?
- What is the difference between role-based access and API key governance for NHI security?
- What is the difference between human IAM controls and NHI governance?
- Why is single-provider AI agent governance not enough for enterprise security?
