I had an AI feature in review, and the DPIA sat in my backlog for three weeks.
Not because I didn't think it mattered. Because I wasn't sure it was required, and I didn't want to write a document that turned out to be the wrong document.
GDPR Article 35(1) says a DPIA is required where processing is "likely to result in a high risk." Article 35(3) then lists the cases where one is required by default: profiling with legal or similarly significant effect, large-scale special-category data, and systematic monitoring. The EU AI Act's high-risk obligations pull the same processing in from the other side.
The problem is not knowing the articles. The problem is mapping our actual system onto them without either over-filing or skipping.
The three inputs that decide the readiness call
The pack takes four inputs: a processing description, whether special-category data is involved, whether it makes automated decisions with legal or similar effect, and the scale (small, medium, large).
I expected the description to drive the verdict. It doesn't. The verdict — what the tool calls the "readiness call" — comes from the other three, deterministically:
| Inputs | Readiness call |
|---|---|
| Special category, automated decision, or large scale | LIKELY REQUIRED |
| No special, no automation, small scale | SCREEN FIRST |
| Everything else (medium, or one flag on a small system) | GAPS |
The logic is four lines, not a prompt:
let readiness = 'gaps'
if (special || auto || scale === 'large') readiness = 'likely_required'
if (!special && !auto && scale === 'small') readiness = 'screen_first'
Same inputs, same call, every run. No model is in the path that produces it. An optional layer can polish the wording, but it is told to keep the headings and not invent legal conclusions.
The five themes are the document skeleton
When the call comes back, the pack hands you five themes to document, pulled straight from Article 35's structure:
- Nature, scope, context and purposes of the AI processing
- Necessity and proportionality of the AI-assisted processing
- Risks to rights and freedoms (the engine names bias, opacity, automation)
- Measures: human review, retention, access, and the vendor's Article 13 information
- The consultation path with your DPO or supervisory authority if residual risk stays high
Theme four is the one I would have under-documented. The engine specifically lists pulling the provider's Article 13 information — the transparency data the vendor owes you under the AI Act. If you built the system yourself, that box is yours to write. If you licensed it, that box is a request to the provider, and the pack tells you to make it.
The evidence gaps are the honest part
The pack does not pretend your draft is finished. It lists three checkboxes it cannot tick for you:
- Pull provider Article 13 information (the tool points at companion packs, InstructPack or VendorVet, for this)
- Map your data categories and retention
- Get counsel or DPO sign-off before treating the DPIA as closed
That third one is the whole point. The pack is built to be handed to counsel, not to replace them. The moment I saw it stop at "sign-off," I stopped worrying that I was writing something I shouldn't.
Why rules-first, not a prompt
I could have built this on a model that reads the processing text and writes the DPIA. I didn't, for a reason the IncidentKit work taught me: a model that rewrites legal structure is worse than no tool, because you can no longer tell the law from the generated text.
The engine version is date-stamped (2026-10-22) so a counsel review can ask "which rules produced this call" and get an answer. A prompt cannot give you that.
You can open DpiaPack and run it without signing up. It is $19/mo, or $190/yr.
What it is not
- Not a completed DPIA. It is a starter pack: themes, a readiness call, and evidence gaps — not a filed assessment.
- Not legal advice. Decision-support. Your DPO or counsel signs the timeline and the conclusions.
- Not a risk classifier. It will not tell you if your system is high-risk under the AI Act. It flags the Article 35 triggers from your three inputs.
- Not broad third-party risk management, and not a certification. Act-focused on the DPIA draft. No vendor scoring beyond the Art. 13 pull, no framework coverage, and it files nothing with any authority.
- Not monitoring. It does not collect logs, watch your deployment, or assess your model's behaviour.
FAQ
Q: Does this decide if my AI system is high-risk under the AI Act?
A: No. It maps your inputs to the Article 35 DPIA triggers (special category, automated decision, scale). Whether the system is high-risk is a legal judgment your counsel makes.
Q: What does the readiness call mean?
A: It is computed from three inputs only: special-category data, automated decisions, and scale. Any one of those three being "yes" or "large" gives LIKELY REQUIRED. None of them on a small system gives SCREEN FIRST. Anything between gives GAPS.
Q: Is the DPIA text written by an AI model?
A: The draft path is rules-only. An optional model layer can polish wording, but it is told to keep headings and not invent legal conclusions. The themes and the call stay deterministic.
Q: Can I get the draft out of the tool?
A: Yes. The result is Markdown you can copy, with a REST endpoint behind the form for live runs.
References
- GDPR — Article 35, Data protection impact assessment (EUR-Lex) — the nine criteria and the three mandatory cases.
- Regulation (EU) 2024/1689 (EU AI Act) — EUR-Lex — the high-risk obligations that pull AI processing into a DPIA from the other side.
- EDPB Guidelines on DPIAs — what a completed assessment should contain.
- DpiaPack — the starter pack tool above.
Top comments (0)