FRIA vs DPIA: How to Run a Combined Impact Assessment for High-Risk AI Systems

What is a DPIA under GDPR — and what is a FRIA under the EU AI Act?

If you're deploying a high-risk AI system in the EU that processes personal data, you're staring at two separate impact assessment obligations from two separate laws. And nobody told you they overlap. That's the core problem this guide solves.

DPIA: Data Protection Impact Assessment (GDPR Article 35)

A DPIA is required under GDPR Article 35 whenever data processing is "likely to result in a high risk to the rights and freedoms of natural persons." For AI, this triggers in familiar scenarios: systematic profiling, large-scale processing of special category data, public area monitoring, and automated decision-making with legal or significant effects. The focus is narrow but deep: privacy rights, data minimisation, purpose limitation, and safeguards for data subjects. If you've been through a GDPR compliance cycle, you've probably run at least one DPIA already.

FRIA: Fundamental Rights Impact Assessment (EU AI Act Article 27)

A FRIA is a newer obligation under Article 27 of the EU AI Act. It applies to certain deployers of high-risk AI systems — specifically public bodies and private entities providing services in Annex III domains including credit scoring (5a), insurance pricing (5b), employment decisions (5c/5d), access to essential services (6), law enforcement adjacent (7), and migration (8). The scope is broader than a DPIA: it covers fundamental rights beyond privacy, including non-discrimination, access to education, employment, housing, social protection, and due process. The FRIA must be completed before the high-risk AI system is put into service, and the results must be notified to the relevant market surveillance authority under Article 27(4). This obligation applies from August 2, 2026.

For the full context on EU AI Act obligations, see our Complete EU AI Act Compliance Guide.

DPIA vs FRIA: key differences, overlaps, and how they fit together

I've run combined assessments for three different mid-market deployers in the past six months, and the biggest misconception I keep hearing is "we already did a DPIA, so we're covered." You're not. Here's why.

Where they overlap (and why running two separate processes wastes time)

Both assessments require you to describe the system, map the context, identify affected persons, assess risks, and define mitigation measures. Running them separately means double interviews, double documentation cycles, and two governance committees reviewing essentially the same system. The Commission, Parliament, and EDPB have all indicated that FRIAs are meant to complement — not replace — existing DPIA practice, and integrated approaches are explicitly encouraged. The efficient approach is a combined workflow that shares the heavy lifting and routes the output into two separate, legally compliant documents.

Do you need a DPIA, a FRIA, or both?

Step 1: Check DPIA triggers (GDPR Article 35)

You need a DPIA if your AI system involves systematic profiling with legal effects, large-scale processing of special category data (health, biometric, criminal), public area monitoring, or automated decision-making that significantly affects individuals. In AI terms: recruitment scoring, credit decisioning, health diagnostics, behavioural profiling, proctoring, and fraud detection almost always trigger DPIA.

Step 2: Check FRIA triggers (EU AI Act Article 27 and Annex III)

You need a FRIA if you're deploying a high-risk AI system AND you're a public body or a private entity providing services in the Annex III domains: creditworthiness assessment (5a), insurance risk pricing (5b), recruitment and employment decisions (5c/5d), access to essential private services (6), law enforcement functions (7), or migration and border control (8). Not every deployer of high-risk AI needs a FRIA — but if you're in one of these domains, you do.

Step 3: Common scenarios where both apply

In practice, most AI systems that trigger a FRIA also trigger a DPIA because they process personal data. Three examples:

Not sure which applies to you? Our FRIA Generator and Deployer Obligation Self-Assessment walk you through the eligibility logic step by step.

How to run a single combined FRIA + DPIA workflow

You can usually run FRIA and DPIA in one coordinated workflow, but don't collapse them into a single legal artifact. Share scoping, interviews, system description, and control mapping, then route that shared material into two separate outputs. Here's the seven-step process.

Use the Combined FRIA + DPIA Wizard (free tool)

The workflow above is exactly what our Combined FRIA + DPIA Wizard implements. It's a guided questionnaire that walks you through all seven steps, collects your answers, and generates separate DPIA and FRIA draft reports. No login, no data collection — everything runs in your browser.

Download FRIA, DPIA, and combined templates

If you prefer to work offline or need to adapt the assessment to your existing governance framework, use these templates directly. The free versions cover the core structure. The E1 toolkit includes pre-filled example scenarios and expanded guidance notes.

Worked examples: how a combined FRIA + DPIA looks in practice

Where FRIA + DPIA sit in your AI governance framework

This combined assessment isn't a side quest. It's the central evidence mechanism of your AI governance system.

If you're using ISO 42001, the combined FRIA + DPIA slots into the Plan-Do-Check-Act cycle as your primary risk assessment artifact. It's how you operationalise Clause 6.1 (actions to address risks and opportunities) for AI-specific deployments.

If you're mapping to NIST AI RMF, the combined assessment lives in the MAP function (context and risk framing) and the MEASURE function (assessing identified risks against defined metrics). The unified risk table from Step 4 above is directly reusable as input to NIST's risk profiling process.

For the detailed framework mappings, see our EU AI Act vs ISO 42001 vs NIST AI RMF crosswalk. If your problem is that you don't know which AI systems you're even deploying, start with the Shadow AI Discovery Protocol before attempting any assessment.

FRIA vs DPIA: frequently asked questions