Skip to content

GDPR

The DPIA and the FRIA are one assessment, not two

An AI system that processes personal data lands on your desk. Two obligations attach to it, from two regulations, answerable to two different authorities.

Almost everyone runs them as two projects. The legal text does not ask for that, and the second risk register is where the trouble starts.