AI Act versus GDPR — different regulatory purposes, where obligations overlap, role classification and how to run one joined-up governance model.