Feature · Duties · Written by Yobel Tzegai · Last checked 9 October 2026

Does your AI system need a DPIA or a fundamental rights impact assessment?

For each AI system whose classification is confirmed, Complipath (complipath.io) says whether a data protection impact assessment (DPIA) and a fundamental rights impact assessment (FRIA) are required, likely or not required for you, with the article each answer rests on quoted in full. Rules decide; nothing in it is drafted by AI.

Check your AI systems, free

What the app says it does

Says whether a data protection or fundamental rights impact assessment is required, likely or not for each system, quoting the article it rests on.

What you get

When a FRIA is required

Article 27(1) binds deployers of a high-risk AI system referred to in Article 6(2), other than a system in the area of point 2 of Annex III, that are bodies governed by public law or private entities providing public services, and deployers of high-risk systems referred to in points 5(b) and (c) of Annex III. They perform the assessment before they deploy the system.

The register does not record whether your organisation is a body governed by public law or a private entity providing public services, so where that decides it, the answer is Likely and names it.

Where it is in the app

On each system's classification page, under Impact assessments, once the system's classification has been confirmed.

What it does not do

Starter

€499 a month

Prices exclude VAT.

  • Up to 20 AI systems
  • Every duty, deadline and article
  • Evidence and the audit log
  • Your first system is free, with no end date
Check your AI systems, free

All plans

Questions

Does Complipath write the DPIA or the FRIA?

No. It says whether each one is required, likely or not. It quotes the provisions behind the answer. Writing the assessment itself is yours: the app says Complipath does not draft it yet, and drafting the DPIA and FRIA documents is not built. The answer tells you which assessment to start.

Who has to do a fundamental rights impact assessment?

Under Article 27(1), deployers of a high-risk AI system referred to in Article 6(2) that are bodies governed by public law or private entities providing public services, except for systems in the area of point 2 of Annex III, and deployers of high-risk systems referred to in points 5(b) and (c) of Annex III, before they deploy it.

Why does a system that is not high-risk get Not required for the DPIA?

Because this answer reads the facts the AI Act classification records, and a system that is not high-risk carries none of them. Whether GDPR Article 35 requires a DPIA for its processing turns on what personal data it handles and how, which is a reading of your processing that stays with you.

Which plan includes it?

Starter, at €499 a month for up to 20 AI systems, and the trial: the app lists this feature for Starter. Prices exclude VAT. Your first system is free, with no end date. Growth and Scale are not available yet, and nothing on this page waits for either of them.

Read next
See what your customers will ask about your AI.No account needed. Every answer cites the article it rests on.