How do you write a DPIA and a FRIA for an AI system?

What it does: a DPIA for AI, and a FRIA

• One DPIA and one FRIA per AI system. The DPIA has four parts, each quoting a point of Article 35(7) of Regulation (EU) 2016/679, the GDPR; the FRIA has six, each quoting a point of Article 27(1) of the AI Act.
• Every sentence is something your register already holds: what the system does and who uses it, its vendor, its status, the classification a person confirmed, confirmed documentation sections, open risks and their actions, requirements marked done, evidence files and logged incidents.
• Each sentence carries its source, with a link to where it came from. A sentence you write is sourced Written by, with your name and the day.
• Where the register holds nothing for a part, the part says what is missing and asks you to write it. Nothing is invented to fill it.
• The DPIA's necessity and proportionality part is always yours to write: the register cannot say it.
• Where the system has a DPIA, FRIA parts (a), (d) and (f) point to DPIA parts (a), (c) and (d), and the FRIA records which DPIA it is built on.
• Read the register again rebuilds the draft and keeps every sentence a person wrote. Any sentence can be taken out; one that came from the register returns on the next read.
• A named person confirms it with that day's date, and never with an empty part. Any later change makes it a draft again.
• PDF and Word carry every part, every sentence and its source, and say whether the document is confirmed or still a draft.
• A confirmed document becomes a source in the audit room, in the confirmer's name and with the date, for questions about impact assessments, data protection, fundamental rights or risk.

Who it is for

Deployers who have to write a fundamental rights impact assessment under Article 27(1), or a data protection impact assessment, and would rather start from the records they already keep than from a blank template.

Whether either applies to a system is a separate check, DPIA and FRIA: whether they apply.

How you use it, step by step

• Confirm the system's classification. On its classification page, Impact assessments then shows whether each applies and links to The DPIA and The FRIA.
• Choose Draft the DPIA from the register, or Draft the FRIA from the register.
• Under each part the register could not fill, use Add a sentence.
• Draft the DPIA first if you want the FRIA to point to it, then draft the FRIA, or read the register again into it.
• Confirm the document, then download it as PDF or Word.

Which plan

Growth feature · included in Starter until Growth launches. The trial and every paid plan open it; on Free the page shows what it does, locked; the download is refused.

Where it sits in the law

• Article 27(1) requires the assessment, before deployment, from deployers of high-risk systems referred to in Article 6(2) that are bodies governed by public law or private entities providing public services, except for systems in the area of point 2 of Annex III.
• It also requires it from deployers of high-risk systems referred to in points 5 (b) and (c) of Annex III.
• Article 27(1) lists six things that assessment consists of, from the deployer's processes in which the system is used to the measures if the risks materialise. The FRIA's six parts are those points.
• Article 27(4), as replaced by Regulation (EU) 2026/1744: where an obligation is already met through the DPIA, the deployer may cross-refer to its relevant sections or include relevant parts of it in the FRIA. In the 2024 text, the FRIA was to complement that DPIA.
• Article 26(9): where applicable, deployers of high-risk AI systems use the information provided under Article 13 to carry out their DPIA under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680.
• Article 27(2): the duty applies to the first use; in similar cases the deployer may rely on earlier assessments, and it updates the FRIA when an element changes.
• Article 27(3): the deployer notifies the market surveillance authority of the results, submitting the filled-out template referred to in Article 27(5); in the case referred to in Article 46(1), deployers may be exempt from notifying.

What it does not do

• No model writes any of it: the drafts are built by rules from your register.
• It does not judge whether the DPIA meets a FRIA obligation. Where a DPIA exists, the FRIA points to it even while it is a draft, and says so; a pointer you take out comes back when the register is read again.
• It does not notify the market surveillance authority under Article 27(3), and it does not fill the questionnaire template the AI Office is to develop under Article 27(5), as replaced.
• It keeps one document per system and kind, not versions. Reading the register again rewrites the register's sentences and makes it a draft again.
• The DPIA is the four points the app quotes from Article 35(7) of the GDPR and nothing more. Whether your DPIA needs more is a reading of your processing that stays with you.
• It is an audit-room source only once confirmed, and only while the audit room is on. There, with AI answer drafts on, as they are by default, its text can go to the drafting model as a source for an answer draft.

Where it is in the app

On each system's classification page, under Impact assessments, once the classification is confirmed: the links The DPIA and The FRIA open the document. Each part shows the point of the law it answers, quoted, above its sentences.