An AI product owner asks how the EU AI Act relates to GDPR study for CIPP/E. What is the right framing?
Select an answer to reveal the explanation.
Short Explanation
The AI Act is another big EU statute on the shelf next to the GDPR — related, interacting, not a delete-and-replace for personal data. CIPP/E wants you to know it belongs in the legislative landscape, not to turn you into a full AI-governance specialist overnight. Keep GDPR for personal data; know the AI Act exists beside it.
Full Explanation
The EU AI Act is related legislation that interacts with GDPR personal-data rules when AI systems process personal data; it does not replace the GDPR, and CIPP/E study is awareness of that interaction rather than a full AIGP governance deep dive. An AI product owner should keep dual compliance in view: high-risk AI duties under the AI Act can coexist with lawful-basis, DPIA, transparency, and rights obligations under the GDPR. The AI Act did not repeal the GDPR for any system labelled artificial intelligence. It is not identical to Convention 108+ and does not void supervisory authorities. It does not apply only outside Europe with no personal-data interaction. Exam caveat: BoK “related legislation” items reward coexistence framing and reject repeal myths. Operational check: before a civic AI pilot that scores benefit applications, list AI Act risk-category tasks and GDPR processing tasks on one RACI so neither workstream assumes the other covers notice, human review, or special-category issues. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.