Where do AI Act and ePrivacy Directive overlap?

In 2 article-level pairings recorded in the Fontvera corpus. The table above lists each pair with the specific articles and a plain-language description.

Where do AI Act and ePrivacy Directive conflict?

In 1 article-level conflicts. The most concrete ones are summarised in the Conflicts explained section.

Which regulation prevails in a conflict between AI Act and ePrivacy Directive?

Neither regulation resolves the conflict on its face. Conflicts are typically resolved by the more specific provision or by regulator guidance — a legal-judgement call, not a mechanical rule.

§ AI Act · ePrivacy Directive COMPARISON

AI Act vs ePrivacy Directive: Where They Overlap and Conflict

2 overlaps, 1 conflicts and 1 gaps mapped between AI Act and ePrivacy Directive in the Fontvera regulatory corpus.

Summary

AI Act and ePrivacy Directive both apply across European business activity, but they were drafted at different times with different policy goals. This page summarises every article-level crossref between the two in the Fontvera corpus.

2 overlaps mean the same conduct triggers obligations in both regimes — design controls once, document twice. 1 conflicts mean the two regulations push in opposite directions on a specific question. 1 gaps mean one regulation leaves something on a topic the other addresses.

Who this applies to

Compliance teams who need to map a single control framework onto both AI Act and ePrivacy Directive.

Compliance deadline

§ Detail

In depth

Summary statistics

Overlaps: 2 · Conflicts: 1 · Gaps: 1

4 article-level crossrefs catalogued between AI Act and ePrivacy Directive from the Fontvera EU regulatory corpus. Article numbers are verbatim from the underlying obligation_crossrefs table; descriptions are extracted, not paraphrased.

All crossrefs between these regulations

Article (A)	Article (B)	Type	Severity	Description
AI Act Art 10	ePrivacy Directive Art 5	overlap	medium	[entity affected: provider] Both regulations require providers to implement technical and organizational measures to ensure data quality and security, with the AI Act focusing on bias/error reduction
AI Act Art 12	ePrivacy Directive Art 6	overlap	medium	[entity affected: provider] Both regulations mandate the recording and processing of data logs; the AI Act requires logging for high-risk AI system monitoring, while ePrivacy restricts traffic data pr
AI Act Art 19	ePrivacy Directive Art 6	conflict	high	[entity affected: provider] The AI Act requires providers to keep automatically generated logs for at least six months, whereas ePrivacy requires traffic data to be erased or anonymized as soon as it
AI Act Art ?	ePrivacy Directive Art ?	gap	medium	[entity affected: deployer] Neither regulation explicitly addresses the liability or compliance obligations for deployers of AI systems that process personal data via electronic communications network

Conflicts explained

The 1 article-level conflicts between AI Act and ePrivacy Directive mean a control that satisfies one can pull the wrong way on the other:

AI Act Art 19 vs ePrivacy Directive Art 6 — [entity affected: provider] The AI Act requires providers to keep automatically generated logs for at least six months, whereas ePrivacy requires traffic data to be erased or anonymized as soon as it is no longer needed for transmission, potentially creating a conflict if logs contain traffic data.

Which regulation takes precedence

EU law does not lay down a universal precedence rule between AI Act and ePrivacy Directive. In practice three resolution approaches apply: lex specialis (the more specific provision wins when both purport to govern the same conduct); regulator guidance (EDPB, EBA, ESMA and the AI Office have all issued joint readings on overlapping articles — check the most recent applicable opinion); and document the choice (when the regulations leave the call to the controller, the audit defence is your written reasoning, not the regulator's silence). Where the corpus surfaces a conflict rather than an overlap, treat that as an escalation path to legal — not a control-design question.

What this means for your compliance team

Treat the 2 overlaps as design opportunities — one control, two regulatory anchors. Treat the 1 conflicts as escalation paths to legal: the regulations themselves don't resolve them, you do, and you document the reasoning. The 1 gaps point at scenarios where one regulation is silent while the other speaks — assume the regulator who has the explicit rule will win.