DPIA and FRIA: how to merge the GDPR impact assessment and AI Act risk analysis into a single file
·
Updated on ·
By 
Aymeric Guyard · 7 min read
In brief
- An AI project processing personal data often triggers two analyses: the DPIA (GDPR art. 35) and, for high-risk systems, the FRIA (AI Act art. 27), backed by the provider's risk management (art. 9). Rather than three documents, build a single, extended file.
DPIA, FRIA, risk management: who does what?
| Analysis | Who | Subject | Legal basis |
|---|---|---|---|
| DPIA | Controller | Risks to data subjects | GDPR art. 35 |
| AI risk management | Provider | Safety and robustness of the system | AI Act art. 9 |
| FRIA | Deployer (high-risk) | Impact on fundamental rights | AI Act art. 27 |
The 7-step method
- Describe the AI system, its purposes, its data and its lifecycle.
- Qualify the AI Act risk level and check whether a DPIA is mandatory.
- Map the personal data, legal bases and data flows.
- Identify the risks: for individuals (GDPR) and for fundamental rights (bias, opacity).
- Assess severity and likelihood, then define mitigation measures.
- Plan for human oversight, logging and information for data subjects.
- Have the DPO validate, date and schedule the review.
Best practice: a single risk table, two reading columns (GDPR / fundamental rights). You avoid duplication, demonstrate integrated governance and facilitate oversight. See also the step-by-step DPIA for an AI project and when a DPIA is mandatory.
When is a DPIA mandatory for AI?
It is mandatory notably in the case of large-scale processing of sensitive data, evaluation or scoring, systematic monitoring, or use of new technologies presenting a high risk — which covers the majority of high-impact AI projects.
Take action
Map your AI systems, conduct your DPIAs/FRIAs and manage your records from a single platform with Data Comply One.
Discover the AI Act software →Test my compliance for free