The regulatory dichotomy: the GDPR and the AI Act

Antonio Tejeda Encinas. Lawyer. President of the Euro-American Committee of Digital Law - CEA Digital Law

Within the vast and intricate web of European regulation, the General Data Protection Regulation (GDPR) and the EU Artificial Intelligence Act (AI Act) stand out as two pillars that reflect the sophistication and global reach of European Union law. Both seek to protect EU citizens and to ensure that technologies and business practices are aligned with European values, yet their approaches and the criteria that determine when they apply are markedly different.

The extraterritorial scope of the GDPR

The GDPR, which took effect in May 2018, transformed the data protection landscape by laying down strict rules on how the personal data of EU residents must be handled. Its extraterritorial application rests on two main criteria:

The establishment criterion:
Under this criterion, the GDPR applies where a company has an ‘establishment’ in the EU and processes personal data in the context of its activities in the Union. The term ‘establishment’ is interpreted broadly here, covering any physical presence that involves the effective conduct of business within the EU.

The targeting criterion:
The GDPR also applies to companies outside the EU that offer goods or services to individuals in the Union or monitor their behaviour. Monitoring may include online tracking through cookies or marketing techniques that analyse user behaviour.

At its core, the GDPR protects individuals’ fundamental rights over their data, ensuring that any entity processing the data of EU citizens does so within a clear and accountable framework.

The extraterritorial scope of the AI Act

By contrast, the AI Act, which entered into force on 1 August 2024, takes a broader and in many respects more aggressive approach. Designed to regulate the use of artificial intelligence technologies that may have an impact in the EU, it applies regardless of whether the provider or developer of the AI intended to target the European market.

This approach stems from the transformative and potentially disruptive nature of AI. The EU wants to ensure that any AI system operating within its jurisdiction meets high standards of transparency, ethics and safety, whatever the developer’s original intention.

The AI Act’s protectionist approach

The AI Act’s protectionist stance may seem strict, but it reflects the EU’s clear intention to lead the world in the regulation of artificial intelligence. By requiring any AI system with an impact in the EU to comply with its rules, the EU protects not only its citizens but also its market and its ethical values. This approach may have several consequences:

Incentives for responsible innovation:
By setting high standards, the EU could foster innovation within an ethical and safe framework. Companies that meet these standards could benefit from a more accessible European market.

Challenges for non-EU companies:
AI companies outside the EU could face significant difficulties in complying with these rules, which could limit the availability of certain services or technologies on the European market.

A position of global leadership:
The EU could consolidate its position as a global leader in AI regulation, setting precedents that other regions might follow and thereby promoting safer and more ethical AI worldwide.

Ultimately, understanding these differences is crucial for global businesses. While the GDPR focuses on consent and intention in the processing of data, the AI Act broadens the scope towards the preventive regulation of emerging technologies. This dichotomy highlights not only the sophistication of EU law but also its leadership in shaping a global environment in which technology serves humanity responsibly and ethically.