The AI Act is one regime among several that govern a sector system. Data protection law governs personal data, including biometric and health data; medical device law governs devices; employment law governs workplace consultation, monitoring and decisions; education law governs admissions, assessment and safeguarding; equality law governs discrimination; and consumer law governs fairness to consumers. Each regime has its own triggers, duties, authorities and remedies, and compliance with the AI Act does not by itself establish compliance with any of them. A combined legal map, naming each regime, the provision engaged and the owner, is the practical tool for a sector deployment. This guide gives no dates for sector law: every sector date must be verified in the sector instrument itself.
Why does the AI Act not stand alone?
The AI Act was designed to sit alongside existing Union and national law, not to replace it. Its recitals and provisions preserve the application of other law, and its classification, transparency and oversight duties are framed to complement, rather than duplicate, the duties in data protection, product safety, employment and consumer law. A system can therefore be compliant with the AI Act's classification and documentation requirements and still breach data protection law by processing special-category data without a lawful basis, or breach employment law by introducing monitoring without consultation, or breach equality law by producing discriminatory outcomes. Conversely, a system can satisfy data protection law and still be prohibited or high-risk under the AI Act. The only reliable approach is to assess each regime on its own terms, for the same system and the same deployment, and to record where the regimes point in the same direction and where they impose different or additional duties.
How does data protection law interact with the AI Act?
Data protection law interacts with the AI Act at almost every point in a sector deployment. Biometric data and health data are special categories of personal data under the General Data Protection Regulation, with heightened conditions for processing; automated decision-making, including profiling, is subject to Article 22 and to data protection impact assessment duties; and the principles of lawfulness, fairness, purpose limitation, data minimisation and accuracy apply to every stage of an AI system's lifecycle. The AI Act's own provisions on data governance, logging, transparency and human oversight overlap with those duties without replacing them, and the AI Act expressly provides for special-category data to be processed for bias detection in defined circumstances, which should be checked in the consolidated text. A deployment file should therefore contain both the AI Act classification and the data protection assessment, describing the same data, purposes and safeguards, with a single data inventory that serves both assessments.
For the broader regulatory framework, see healthcare and biometrics under the AI Act.
How do employment and education law interact with the AI Act?
Employment law governs the introduction of monitoring and evaluation systems, consultation with workers' representatives, the information workers must receive, and the fairness of decisions on hiring, promotion, discipline and termination. Education law governs admissions, assessment, appeals, safeguarding and the duties owed to learners, including children and young people. Those regimes can require consultation, information, consent or approval that the AI Act does not itself require, and they can impose substantive limits on a use that the AI Act would classify but not prohibit. A deployer should therefore map the employment or education law position for its Member State and institution, with qualified advice, before the AI Act file is treated as complete. The map should record the consultation carried out, the information given, the safeguards agreed and the review route, so a later challenge under employment or education law can be answered from the same file that answers an AI Act question.
How do equality and consumer law interact with the AI Act?
Equality law prohibits discrimination on protected grounds, including in employment, education and the provision of services, and an AI system that produces uneven outcomes across groups can engage equality law even where its classification and documentation are in order. The AI Act's data governance and bias monitoring requirements support equality compliance, but they do not replace the equality assessment, which must consider the outcomes, the justification and the reasonable adjustments that apply in the sector. Consumer law governs fairness, misleading practices and the information consumers must receive, and it can apply to AI-driven pricing, recommendation and customer interaction in ways the AI Act's transparency duties do not cover. A deployment file should therefore include an outcome-monitoring record, showing whether the system's results differ across groups and what action was taken, and a consumer information record where the system faces consumers. Those records are part of the same evidence chain as the AI Act file, and they should be reviewed together.
How should a combined legal map be built?
A combined legal map should list, for each system version, each regime engaged, the provision concerned, the duty it imposes, the owner for that duty, the evidence that supports compliance, and the review trigger. The map should be built by the legal, compliance, data protection, sector and operational owners together, so no regime is assessed in isolation and no duty is assumed to be covered by another regime's work. The map should be dated, sourced and reviewed when the system, the deployment or the law changes, and it should distinguish fixed law from guidance and expected change in each regime. A map that lists only the AI Act, or that lists other regimes without provisions and owners, is a label rather than a tool. The test for the map is whether a reviewer can see, for any duty, who owns it, what evidence supports it and when it was last checked, without needing to ask the team that wrote it.
Continue with healthcare AI and medical device law.
What does this guide not decide?
This guide does not decide the position under any sector regime for any specific system, does not give data protection, employment, education, equality or consumer law advice, and does not state any sector law date. Sector positions depend on the system, the deployment, the Member State and the sector instrument, applied to the specific facts with qualified advice in each regime. The guide also does not cover professional regulation, clinical governance or safeguarding duties beyond the outline given here. Where a sector deployment is planned, confirm the position under each applicable regime with the relevant competent authority or legal adviser, and keep the combined legal map with the system's compliance record.
Frequently asked questions
Does AI Act compliance guarantee data protection compliance?
No. Data protection law imposes its own duties on personal data, special-category data, automated decisions and impact assessment. Both regimes must be assessed for the same system and deployment, with a shared data inventory.
Can a system be lawful under the AI Act but unlawful under employment law?
Yes. Employment law can require consultation, information or substantive limits that the AI Act does not impose. The employment law position for the Member State concerned must be checked separately.
Should sector law dates be taken from this guide?
No. This guide gives no sector law dates. Every sector date must be verified in the sector instrument itself, and the source and date checked should be recorded.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗