FRIA & DPIA for AI systems
Deployers of AI systems that must produce a FRIA and/or a DPIA — particularly public bodies and regulated sectors.
Updated: 2026-09
This package produces the impact assessments an AI system often needs simultaneously: the fundamental rights impact assessment (FRIA) under Article 27 of the AI Act and the data protection impact assessment (DPIA) under Article 35 GDPR — integrated rather than duplicated, as one audit-ready assessment with a clear approval decision.
Many high-risk AI systems trigger two impact assessments at once: the FRIA for the fundamental rights dimension and the DPIA for data protection. Produced separately, they create duplicated work and contradictory versions that can be used against you in an audit.
An integrated assessment avoids that — it covers both perspectives from one source, with a traceable risk analysis and a documented approval decision.
What you get
FRIA under Article 27
A fundamental rights impact assessment with the statutory minimum content.
DPIA under Article 35
A data protection impact assessment, integrated rather than duplicated.
Risk analysis
Concrete risks, likelihood, severity and mitigation.
Approval decision
A documented assessment as the precondition for lawful operation.
How it runs
- 01
Scope
Clarifying which assessments the system triggers.
- 02
Analysis
Capturing affected persons, risks and the fundamental rights dimension in a structured way.
- 03
Mitigation
Assessing measures and residual risk.
- 04
Approval
A documented decision and handover of the assessment.
Price framing
As an engagement or a package. We discuss scope and price range in a first conversation and put both in writing.
Indicative, not a binding quote — the frame is confirmed during scoping.
What drives the price? → Cost guide
Parent service: EU AI Act & Compliance Advisory
FAQ
Do we need both assessments?
We clarify that first. Often both apply, sometimes only one — the integrated approach covers both without duplicating.
As a public body, are we obliged to produce a FRIA?
Public bodies deploying high-risk systems are obliged to produce a FRIA and to notify the supervisory authority. The package is designed for exactly that.
Is this legal advice?
No. We deliver the structured, audit-ready impact assessment; borderline legal questions we settle with legal advice.
FRIA & DPIA for AI systems
Deployers of AI systems that must produce a FRIA and/or a DPIA — particularly public bodies and regulated sectors.