# DPIA screening checklist for AI

For a high-risk system you deploy, where a data protection impact assessment is required the AI Act has you use the provider's Article 13 information to carry it out (Article 26(9)), and where it already meets an obligation of Article 27 your fundamental rights impact assessment may cross-refer to it or include its relevant parts (Article 27(4), as replaced). This free checklist from complipath.io covers that AI Act side and leaves to you whether GDPR Article 35 requires the assessment.

## Does the AI Act side apply?

- Is the system high-risk under Article 6, by a classification a person has confirmed?
- Are you its deployer? Article 26(9) is a deployer duty.
- Is a data protection impact assessment required for it, under GDPR Article 35 or Article 27 of Directive (EU) 2016/680? That question is outside this checklist: see where it stops, below.
- When: Article 26 applies from 2 December 2027 for systems high-risk under Article 6(2) and Annex III and from 2 August 2028 under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

Provision: Article 26(9)

## What to take from the instructions for use

- The provider's identity and contact details, and its authorised representative's where applicable (point (a)).
- The intended purpose (point (b)(i)).
- The level of accuracy, including its metrics, robustness and cybersecurity it was tested and validated against and that can be expected, and the known and foreseeable circumstances that may affect it (point (b)(ii)).
- Known or foreseeable circumstances, in intended use or under reasonably foreseeable misuse, that may lead to risks to health and safety or fundamental rights (point (b)(iii)).
- Where applicable, its technical capabilities and characteristics to provide information relevant to explain its output (point (b)(iv)).
- When appropriate, its performance regarding specific persons or groups of persons it is intended to be used on (point (b)(v)).
- When appropriate, specifications for the input data, or other relevant information on the training, validation and testing data sets used, taking into account its intended purpose (point (b)(vi)).
- Where applicable, information to interpret its output and use it appropriately (point (b)(vii)).
- Changes to the system and its performance pre-determined at the initial conformity assessment, if any (point (c)).
- The human oversight measures of Article 14, including the technical measures that help interpret its outputs (point (d)).
- The computational and hardware resources needed, its expected lifetime and the maintenance and care measures, with their frequency, including software updates (point (e)).
- Where relevant, the mechanisms to collect, store and interpret its logs in accordance with Article 12 (point (f)).

Provision: Article 13(3)

## If a fundamental rights impact assessment is also due

- Does Article 27(1) reach you? It does if you deploy a high-risk system referred to in Article 6(2), outside the area of point 2 of Annex III, and you are a body governed by public law or a private entity providing public services, or if the system is referred to in points 5(b) and (c) of Annex III.
- Which obligations of Article 27 does your data protection impact assessment already meet? For those, the fundamental rights impact assessment may cross-refer to its relevant sections or include its relevant parts.
- The AI Office's questionnaire template is to give deployers the same possibility where relevant (Article 27(5), as replaced by Regulation (EU) 2026/1744). Article 27(5) sets no date for it, and whether it has been published was not checked against our sources.

Provision: Article 27(4), as replaced by Regulation (EU) 2026/1744

## Registration, for public authorities

- A deployer that is a public authority, a Union institution, body, office or agency, or a person acting on their behalf registers itself, selects the system and registers its use in the EU database before putting into service or using a high-risk system listed in Annex III, other than in point 2 (Article 49(3)).
- That registration includes a summary of the data protection impact assessment, where applicable (Section C, point 5, of Annex VIII).
- For systems in points 1, 6 and 7 of Annex III in the areas of law enforcement, migration, asylum and border control management, the registration is in a secure non-public section and, of Section C of Annex VIII, includes only points 1 to 3 (Article 49(4)).

Provision: Article 49(3) and (4)

## Where this checklist stops

- Whether a data protection impact assessment is required is decided under GDPR Article 35, or Article 27 of Directive (EU) 2016/680. Neither is in the law this checklist was checked against, so it names them and does not quote or summarise them.
- Data protection law applies to personal data processed in connection with the AI Act's rights and obligations, and the AI Act does not affect the GDPR, without prejudice to its Articles 4a and 59 (Article 2(7), as replaced by Regulation (EU) 2026/1744).
- Practice: take the GDPR question to your data protection officer or counsel, with the provider's information from the instructions for use.

Provision: Article 2(7), as replaced by Regulation (EU) 2026/1744

## What to record

- The system, its classification and the date a person confirmed it.
- Whether a data protection impact assessment was found required, by whom and on which reading, and where it is kept.
- Which version of the instructions for use you took the Article 13 information from.
- When to screen again: a new purpose, new data or a new provider.

Source: https://www.complipath.io/templates/dpia-screening-checklist-ai/