DPIA or FRIA: which one does your AI system need?

Whether you need a data protection impact assessment (DPIA) is decided by Article 35 of the GDPR, Regulation (EU) 2016/679, or Article 27 of Directive (EU) 2016/680, not by the AI Act. A fundamental rights impact assessment (FRIA) is the AI Act's own: Article 27(1) requires one from three kinds of deployer of high-risk systems referred to in Article 6(2), outside point 2 of Annex III. One system can need both.

Written and last checked 9 October 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Article 27(4) and (5) were replaced; Article 26 and Article 27(1) to (3) were not amended.

Where does each assessment come from?

The FRIA is an AI Act duty. Article 27(1) has the deployers it names "perform an assessment of the impact on fundamental rights that the use of such system may produce", before deploying the system. The Article 27 guide covers who they are.

The DPIA is not created by the AI Act. Article 26(9) reads: "Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680." The obligation is "their obligation" under those acts; Article 26(9) only says what to use for it.

Article 2(7), as replaced, keeps the two regimes apart: "Without prejudice to Articles 4a and 59 of this Regulation, this Regulation shall not affect Regulation (EU) 2016/679 or (EU) 2018/1725, or Directive 2002/58/EC or (EU) 2016/680." The GDPR comparison covers the wider overlap.

When is a DPIA required for an AI system?

The AI Act does not answer that. Its text mentions a data protection impact assessment in four places, Article 26(9), Article 27(4) and (5) and point 5 of Section C of Annex VIII, and every one concerns deployers of high-risk systems. None of them sets the condition under which a DPIA is required.

That condition is in Article 35 of Regulation (EU) 2016/679, or Article 27 of Directive (EU) 2016/680 where that directive applies, and neither text is in the sources this guide is checked against. So this guide does not quote or paraphrase them. Read the GDPR article itself before deciding a system needs no DPIA, whatever its AI Act risk level.

What the AI Act does settle is one input. A deployer of a high-risk system uses "the information provided under Article 13", the provider's transparency information and instructions for use, where a DPIA applies.

What must a FRIA contain?

Article 27(1) lists six points: (a) a description of the deployer's processes in which the system will be used in line with its intended purpose; (b) a description of the period of time within which, and the frequency with which, it is intended to be used; (c) the categories of natural persons and groups likely to be affected by its use in the specific context.

Then (d) the specific risks of harm likely to have an impact on those categories, "taking into account the information given by the provider pursuant to Article 13"; (e) a description of the implementation of human oversight measures, "according to the instructions for use"; (f) the measures to be taken if those risks materialise, "including the arrangements for internal governance and complaint mechanisms".

How do the two fit together?

Article 27(4), as replaced, keeps its condition: an obligation in Article 27 "is already met through the data protection impact assessment conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680". The consequence changed. The 2024 wording said the FRIA "shall complement that data protection impact assessment".

Now the deployer "may, when conducting the fundamental rights impact assessment referred to in paragraph 1 of this Article, include cross-references to the relevant sections of that data protection impact assessment or include relevant parts thereof in the fundamental rights impact assessment". Article 27(5), as replaced, has the AI Office's template give deployers that possibility "where relevant". Article 27(5) sets no date for the template.

The FRIA's results go to the market surveillance authority with the filled-out template, and "In the case referred to in Article 46(1), deployers may be exempt from that obligation to notify" (Article 27(3)). The AI Act sets no such notification for a DPIA.

A deployer that registers its use under Article 49(3), a public authority, a Union institution, body, office or agency or a person acting on their behalf, submits "A summary of the findings of the fundamental rights impact assessment conducted in accordance with Article 27" and a summary of the DPIA, "where applicable" (points 4 and 5 of Section C of Annex VIII). For systems referred to in points 1, 6 and 7 of Annex III, "in the areas of law enforcement, migration, asylum and border control management", Article 49(4) limits the registration to points 1 to 3 of Section C, so neither summary is included.

When does each apply?

Articles 26 and 27 sit in Chapter III, Section 3, which Article 113, third paragraph, point (c), as replaced, applies from 2 December 2027 to systems high-risk under Article 6(2) and Annex III, the whole of Article 27's reach. Article 26(9) also reaches systems high-risk under Article 6(1) and Annex I, from 2 August 2028, except systems related to products under Section B of Annex I, to which Article 2(2), as replaced, applies only Article 6(1), Article 60a and Articles 102 to 112.

Those dates are the AI Act's; they do not date a DPIA duty under the GDPR.

What does Complipath do here, and what does it not?

DPIA and FRIA screening, in Starter and the trial, answers, for each system whose classification a person has confirmed, whether a DPIA and a FRIA are Required, Likely, with the one fact that decides it, or Not required for you, and prints in full the provisions each answer rests on.

A rule decides each answer from facts on the register. The DPIA rule is Complipath's reading, not a sentence of the law: a high-risk system that makes, supports or informs decisions about people under point 4 or point 5(b) of Annex III is Required, another high-risk one that does is Likely, and every other system is Not required for you. Where the FRIA turns on whether you are a body governed by public law or a private entity providing public services, which the register does not record, the answer is Likely and names that fact.

Writing either assessment is yours: drafting the DPIA and FRIA documents is not built. Every live feature is listed; EU AI Act compliance software compared quotes other tools in their own words.

What this means for you

If you're a provider: the AI Act gives you no DPIA and no FRIA duty as provider, but both assessments of your customers draw on your Article 13 information, and Article 27(2) lets a deployer rely, in similar cases, on existing impact assessments you carried out.

If you're a deployer: ask two separate questions of each high-risk system. Does Article 27(1) name you for it? Does Article 35 of the GDPR require a DPIA for the processing? Where both are yes, write the DPIA first. Where it already meets an Article 27 obligation, the FRIA may cross-refer to its relevant sections or include relevant parts of it (Article 27(4), as replaced). Article 26 carries the rest of your duties.

FAQ

Does a DPIA satisfy the fundamental rights impact assessment? No. Article 27(1) still requires the FRIA. Where an Article 27 obligation is already met through a DPIA under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, Article 27(4), as replaced by Regulation (EU) 2026/1744, lets the deployer cross-refer to the relevant sections of that DPIA or include relevant parts of it in the FRIA.

Does the AI Act require a DPIA for high-risk AI systems? Not by itself. Article 26(9) has deployers of high-risk systems use the provider's Article 13 information to comply with their obligation to carry out a DPIA under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, where applicable. Whether that obligation exists is decided by those acts, not by the AI Act.

Who has to do a fundamental rights impact assessment? Under Article 27(1), deployers that are bodies governed by public law or private entities providing public services, for high-risk systems referred to in Article 6(2) outside point 2 of Annex III, and every deployer of a high-risk system referred to in point 5(b) or (c) of Annex III. Providers have no FRIA duty unless they deploy the system themselves.

Can one document serve as both the DPIA and the FRIA? The AI Act does not merge them. It lets the deployer include in the FRIA cross-references to the relevant sections of the DPIA or relevant parts of it (Article 27(4), as replaced). The AI Office's template is to offer that possibility where relevant (Article 27(5), as replaced). Whether the DPIA meets the GDPR is a question for the GDPR.

Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 2(2) and (7), Article 6, Article 13, Article 26, Article 27, Article 46(1), Article 49, Article 113 and Annexes I, III and VIII; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which replaced Article 2(2) and (7), Article 27(4) and (5) and Article 113, third paragraph, point (c) (Article 1, points (2), (13) and (40)). Article 26, Article 27(1) to (3), Article 49 and Section C of Annex VIII were not amended. Article 35 of Regulation (EU) 2016/679 and Article 27 of Directive (EU) 2016/680 are not in our source corpus and are not quoted here.

Where this question meets the product: DPIA and FRIA screening. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire. The feature that does this in the app: every live Complipath feature. Tools ranked on it: EU AI Act compliance software compared.