Anyone deploying a high-risk AI system that processes personal data may owe two impact assessments: a data protection impact assessment under data protection law and a fundamental rights impact assessment under the AI Act. Both ask about risks to people, but not the same ones. Doing them separately doubles the work; confusing them leaves a duty uncovered.
The data protection impact assessment
A DPIA is required under Art. 22 FADP and Art. 35 GDPR when processing is likely to result in a high risk to the personality or fundamental rights of data subjects, for example large-scale processing of sensitive data or systematic monitoring. It describes the processing, assesses risks to data subjects and sets measures. If a high residual risk remains, Swiss law requires consulting the FDPIC.
The fundamental rights impact assessment
The fundamental rights impact assessment under Art. 27 AI Act applies to certain deployers of high-risk AI: public bodies, private entities providing public services and deployers of systems for creditworthiness assessment or risk assessment and pricing in life and health insurance. It looks not only at data protection but at fundamental rights overall: non-discrimination, access to services, fair procedures, legal remedies. Under the Digital Omnibus it applies to Annex III high-risk systems from 2 December 2027.
The differences
- Trigger: the DPIA is triggered by high-risk processing of personal data, the FRIA by certain deployers using a high-risk AI system.
- Perspective: the DPIA asks about protection of personality and data, the FRIA about all affected fundamental rights, even without a narrow personal data link.
- Addressee: the DPIA goes to the FDPIC or data protection authority where needed, the FRIA result is notified to the market surveillance authority.
- Content: the FRIA expressly requires information on the deployment process, frequency, affected groups, human oversight and complaint mechanisms.
One process, two outputs
The AI Act expressly provides that the FRIA complements an existing DPIA. In practice a shared process works well: one description of the system and its use that both assessments draw on; a risk analysis that lists data protection risks and other fundamental rights risks side by side; a shared catalogue of measures; and two outputs, each meeting the minimum content of its duty. The basis for both is the provider’s documentation, in particular the technical documentation and instructions for use.
Timing
Both assessments take place before first use and are updated when essential circumstances change. Anyone introducing an AI system today that will fall under the high-risk obligations from December 2027 should already consider the FRIA content in the DPIA rather than retrofit later.
Relevance for Switzerland
For Swiss companies the FADP DPIA applies regardless of the AI Act. The FRIA becomes relevant when they deploy a high-risk system in the EU or its output is used there. Our high-risk classification checklist reviews the classification; all related content is collected in the AI regulation topic page.