This thesis argues that applying the GDPR and the EU AI Act concurrently to AI systems creates a dual regulatory burden, but not irreconcilable conflicts often feared. Whenever an AI system processes personal data, both regimes apply: the GDPR as a rights-based data protection law and the AI Act as a risk-based product safety law. Since the AI Act leaves the GDPR unaffected, except for two narrow exceptions, and neither is a lex specialis, the two operate cumulatively and in parallel. Applying a conflict-of-norms framework that distinguishes between harmonious overlaps, pre-resolved tensions, actual tensions, and genuine conflicts, this thesis examines each point of contact between the two regimes. No genuine conflicts emerge: simultaneous compliance is always possible, and the residual friction takes the form of tensions, concentrated where the AI Act’s acceptance of residual risk meets the GDPR’s non-disposable rights. The available interface clauses and contractual tools make the burden manageable rather than prohibitive. However, many interpretational uncertainties remain unsolved.