AI Act and GDPR: which record you need for each
28 October 2026 · Sources checked on 28 October 2026.
A company that uses AI to process data about people has two European laws to deal with: the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the EU AI Act (Regulation (EU) 2024/1689). Both ask for documentation, but not the same documentation nor in the same way. This article summarises what each official text says as it applies today; it does not interpret and it does not constitute legal advice.
The GDPR: the record of processing activities (Article 30)
The GDPR has applied since 25 May 2018 (Article 99(2)). Its Article 30 requires each controller to maintain a record of processing activities under its responsibility, with these contents (paragraph 1):
- (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;
- (b) the purposes of the processing;
- (c) a description of the categories of data subjects and of the categories of personal data;
- (d) the categories of recipients, including recipients in third countries or international organisations;
- (e) where applicable, transfers to a third country or an international organisation;
- (f) where possible, the envisaged time limits for erasure of the different categories of data;
- (g) where possible, a general description of the technical and organisational security measures.
The processor keeps its own record of the categories of processing it carries out on behalf of each controller (paragraph 2). The records are in writing, including in electronic form (paragraph 3), and are made available to the supervisory authority on request (paragraph 4).
The exemption in paragraph 5 is the one an SME looks at most: the obligations in paragraphs 1 and 2 do not apply to an enterprise or organisation employing fewer than 250 persons "unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10".
If an AI system processes personal data (a CV filter, a chat that serves identified customers), that processing is one more activity in the Article 30 record, with its purposes, its categories of data and its recipients.
The AI Act: there is no Article 30, but you need to know what you use
The AI Act has no article requiring those who use AI (the "deployer", Article 3, point (4)) to keep a record with fixed contents. What it does require, however, rests on knowing which AI systems are used, for what and on whom:
| What it requires | Article | From |
|---|---|---|
| Taking measures to support the AI literacy of those who operate the systems | Article 4 | 2 February 2025 |
| Not using systems for the prohibited practices | Article 5 | 2 February 2025 (points (ba) and (bb): 2 December 2026) |
| Informing people exposed to an emotion recognition or biometric categorisation system and disclosing deep fakes | Article 50(3) and (4) | 2 August 2026 |
| Keeping the logs automatically generated by high-risk systems, to the extent they are under the deployer's control, for at least six months | Article 26(6) | 2 December 2027 (Annex III) and 2 August 2028 (Annex I) |
| Performing and notifying the fundamental rights impact assessment, for those required to do so | Article 27 | 2 December 2027 |
The "logs" of Article 26(6) are the ones the high-risk system itself generates, not a company record. Registration in the EU database under Article 49 falls on the providers of Annex III high-risk systems and, among deployers, only on public authorities, Union bodies and persons acting on their behalf (Article 49(3)).
Where they meet
- **The impact assessment.** Article 26(9) of the AI Act says that, where applicable, deployers of high-risk systems shall use the information the provider gives them (Article 13) for the data protection impact assessment under Article 35 of the GDPR. And, if the GDPR assessment already meets any of the obligations of Article 27, Article 27(4) allows the fundamental rights impact assessment to include cross-references to its relevant sections or the relevant parts of it.
- **Special categories for bias correction.** Article 4a, added by Regulation (EU) 2026/1744, exceptionally allows special categories of data to be processed to detect and correct biases, subject to conditions. One of them concerns the GDPR record: that the records of processing activities "include the reasons why the processing of special categories of personal data was strictly necessary to detect and correct biases, and why that objective could not be achieved by processing other data" (Article 4a(1), point (f)).
- **The same starting data.** Both require knowing which tool is used, from which provider, for what, whom it affects and what data it processes.
How to keep both without duplicating work
- List the AI systems the company uses with their provider, their use and the people they affect.
- Mark those that process personal data and, among them, those that process special categories.
- For each of those, check that its processing is in the GDPR record of processing activities (or note why the company does not keep one, under Article 30(5)).
- For the AI Act, record for each system the prohibited practices review, the classification and the training, and keep the evidence.
- Review both when a tool or its use changes.
The AI Inventory template covers the AI Act side: the "AI systems" database records each system with "Provider", "Purpose", "Affects", "Processes personal data" and "Processes special categories of data", which help match it against the GDPR record, and the reference databases come preloaded with Articles 4, 5, 26, 27 and 50 with their date and their EUR-Lex link: AI Inventory. It does not replace the GDPR record of processing activities, which is a separate document.
Sources (opened on 28 October 2026)
- Regulation (EU) 2016/679 (GDPR) of 27 April 2016, the version in force given by EUR-Lex (no amendments; only corrigenda): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679 — Articles 30 and 99.
- Regulation (EU) 2024/1689, consolidated text as of 27 July 2026, the current consolidated version given by EUR-Lex (EUR-Lex): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727 — Articles 3, 4, 4a, 5, 26, 27, 49, 50 and 113.
- Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (OJ L of 24 July 2026): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744 — Article 1, point (6) (Article 4a).
Document organisation tool based on official texts; it does not constitute legal advice.