High-Risk Categorisations in GDPR vs AI Act: Overlaps and Implications

Under the EU General Data Protection Regulation (GDPR), the processing of personal data with new technologies (including Artificial Intelligence) requires conducting a Data Protection Impact Assessment (DPIA) to evaluate potential risks to the rights and freedoms of individuals. In addition to defining categories of processing that require a DPIA, the GDPR empowers Data Protection Authorities (DPAs) to define additional categories where a DPIA must be conducted. In 2024, the EU adopted the AI Act, which classifies artificial intelligence (AI) technologies according to their level of risk to fundamental rights, democracy, and society. It also requires conducting a Fundamental Rights Impact Assessment (FRIA). The compelling question thus emerges of how and where DPIAs are required and what their relationship is vis-a`-vis the risk assessment required by the AI Act. This paper first analyses DPIA requirements collected from all 27 EU member states and 3 EEA countries and then compares them with the 'high-risk' areas defined in the EU AI Act's Annex III. We show the overlaps, gaps, and divergence in EU Member States approaches regarding applying DPIAs to AI. We also discuss how such assessments require coherence and cooperation regarding information sharing across the AI value chain to identify and resolve risks and impacts efficiently. Our findings are significant for the implementation of the GDPR and AI Act and cooperation between their respective authorities. They also highlight the necessity to harmonise the application of DPIAs with the AI Act's high-risk areas.