What is the difference between a DPIA and an AI risk assessment?
A Data Protection Impact Assessment (DPIA) under GDPR Art. 35 evaluates risks to data subjects from personal data processing. An AI risk assessment under the EU AI Act Art. 9 evaluates risks from the AI system itself — including safety, fundamental rights, and societal impact.
They serve different regulatory purposes, produce different evidence, and must be run as separate governance steps even when they concern the same AI system. One cannot substitute for the other.
Key points
- A DPIA assesses risks to individuals from data processing. An AI risk assessment assesses risks from the AI system's design, behaviour, and deployment context.
- The DPIA is triggered by processing type (profiling, large-scale special categories, systematic monitoring). The AI risk assessment is triggered by risk classification under the AI Act.
- Both may be required for the same system, but they produce separate governance records with distinct evidence requirements.
- Conflating the two creates regulatory risk: a DPIA does not satisfy AI Act risk management obligations, and an AI risk assessment does not satisfy GDPR impact assessment requirements.
Why it matters
Organizations often ask whether a DPIA "covers" the AI risk assessment or vice versa. The answer is no. Treating one as a substitute for the other creates a compliance gap for the regime that was not properly assessed. Both assessments must exist, must be documented separately, and must connect to their respective obligation structures.
How EAB approaches this
EAB separates the two assessments structurally. The DPIA module handles data protection impact assessments with their specific evidence requirements. AI risk assessment is part of the AI Screening and Risk Management Record. The GDPR–AI Act Bridge links both records for systems that fall under both regimes.