AI Governance & data protection: How companies can leverage synergies effectively

Even though the GDPR and the AI Act pursue different objectives (protection of personal data vs. technology-related risk management) there are numerous overlaps with regards to their content. These include, among other things:

• the processing of personal data during the training or deployment of AI systems,
• the assessment of risks to fundamental rights,
• accountability and documentation requirements,
• requirements for transparency and user information,
• the design and implementation of technical and organizational measures,
• as well as governance and risk management processes.

It is important to note that the AI Act expressly leaves the GDPR unaffected. Both sets of regulations apply concurrently whenever an AI system processes personal data. In practice, this results in a growing need for integrated compliance structures to avoid redundancies and leverage synergies.

Over the past few years, many organizations have established robust data protection management systems. However, with the entry into force of the AI Act, they must now address a multitude of new requirements.

At the same time, the new regulation presents an opportunity to consolidate existing processes and leverage synergies in a targeted manner. This is because both the GDPR and the AI Act address key topics such as transparency, risk management, and security requirements, albeit from different perspectives.

The focus is on nine mandatory areas that are particularly relevant for integrated implementation:

1. Compliance Management System
2. Impact Assessment
3. Documentation & Evidence
4. Information obligations
5. Supplier Management
6. Security & Measures
7. Incident Reporting
8. Data Governance & Data Quality
9. Training & Competence

In our White Paper, we analyze these areas in terms of their regulatory foundations and content overlaps, and demonstrate how companies can take the first steps toward integrating both sets of regulations.

An integrated governance system for data protection and artificial intelligence alike requires well-thought-out approaches that are effective both strategically and operationally. Three fundamental principles can serve as a guide:

• Role- and risk-oriented: The obligations under the GDPR and the AI Regulation arise from the company’s role as well as a risk assessment. This logic should be organizationally embedded in an integrated system.
• Lifecycle-based: Data compliance is not a static state, but an ongoing process: from development through operation to decommissioning of a system.
• Evidence-based: Both regulations require accountability, not only in terms of content but also in terms of documentation. A consolidated evidence system can ensure transparency during internal and external audits.

International standards provide a valuable foundation for organizing data protection and AI compliance in a structured and verifiable manner. Particularly relevant are:

• ISO/IEC 27701 supplements ISO 27001 with requirements for data protection and supports the establishment of a Privacy Information Management System.
• ISO/IEC 42001 establishes requirements for an AI management system for the first time - with a focus on risk management, transparency, and governance.
• ISO/IEC 38507 provides guidelines for enterprise-wide AI governance from the perspective of IT and corporate governance.

All three standards are structurally compatible and can be easily combined. They help to further develop existing systems and efficiently implement regulatory requirements.

Our White Paper “Data Protection Meets AI Act: Unlocking Synergies and Streamlining Compliance” provides hands-on recommendations for companies looking to expand their existing data protection processes with AI-specific governance structures.

It highlights which obligations overlap, how to avoid duplication of effort, and which standards and processes can serve as a guide - all of it in a practical, structured manner with a strong focus on operational feasibility.

In our White Paper, you’ll find:

• a clear overview of the interfaces between the GDPR and the AI Act,
• practical suggestions for integrated workflows and role models,
• as well as approaches for a strategic vision of a scalable and future-oriented governance system.

Download the document now and take the next step toward your integrated AI compliance.