Two texts, two objects: do not confuse them.

We mix them up constantly, and this confusion leads us to believe we're compliant when we're only compliant on one side.

GDPR protects individuals

It applies as soon as there is personal data: a name, an email, an identifier. It requires a legal basis, a purpose, a retention period, and it grants rights to the data subjects. That's the topic of the previous lesson.

The AI Act governs systems

It applies to artificial intelligence systems themselves, regardless of personal data. A tool that sorts job applications is covered even if it only processed anonymous numbers: what's regulated is how it's used and what it decides.

The practical consequence

The two stack. A CV-sorting tool falls under GDPR (candidate data) and the AI Act (sensitive use in employment). Being compliant on one says nothing about the other.

What matters is your role

The text distinguishes between those who build a system and those who use it. An SME using off-the-shelf tools is almost always a user, and a user's obligations are nowhere near those of a manufacturer.

Be careful though: if you take an existing tool and substantially modify it or market it under your own brand, you can tip over to the manufacturer side. That's the only point worth getting advice on if you're affected.