Procedure
Integrated AI and Privacy Assessment Procedure
A single system can fall in scope of more than one assessment regime at once: the data protection impact assessment (DPIA) under GDPR Article 35, the automated decision-making (ADM) provisions of GDPR Article 22, the AI System Impact Assessment for a high-risk AI system, and the fundamental rights impact assessment (FRIA) under EU AI Act Article 27. The library carries each instrument separately. This procedure is the router that ties them together: given a system's regime triggers, it says which assessments to run, which limb each one owns, and how they compose into one coordinated pass.
- Type
- Procedure
- Version
- 0.1.6
- Date
- 2026-09-05
- Owner
- AI Risk Maintainer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- AI Governance
- Review frequency
- 6 to 12 months and upon material AI risk or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Trigger events
- Procedure
- Roles and responsibilities
- Framework alignment
- Required outputs
Frameworks it maps to
- ISO/IEC 42005:2025
- EU GDPR (Regulation (EU) 2016/679)
- EU AI Act (Regulation (EU) 2024/1689)
- Canada Treasury Board Directive on Automated Decision-Making
- NIST Privacy Framework 1.0
Related documents
- AI System Impact Assessment Procedureai
- AI Algorithmic Compliance Checklistai
- AI Governance and Risk Frameworkai
- Automated Decision-Making and Profiling Registerprivacy
- DPIA (Data Protection Impact Assessment) Templateprivacy
- Privacy and Data Governance Policyprivacy
Next
All Documents