EU AI Act for Data Protection Officers
For DPOs: where GDPR and EU AI Act duties overlap (DPIA, FRIA) and what Scanara supports. Next step: open the sample report.
Where the GDPR and the EU AI Act meet
Two impact assessments can apply to one system
A GDPR data protection impact assessment (DPIA, Article 35) and an AI Act fundamental rights impact assessment (FRIA, Article 27) can both apply. If a DPIA already meets an Article 27 obligation, the FRIA complements it (Article 27(4)).
The Act names no DPO task
The AI Act does not mention data protection officers. The deployer or provider decides who prepares the assessments. Under GDPR Article 39, the DPO advises on the DPIA when asked.
Deployers reuse the provider’s information
Where applicable, deployers of high-risk systems use the information the provider gives under Article 13 to carry out their DPIA (Article 26(9)). Ask the provider for it early.
What Scanara supports for DPOs
Separate guided assessments
Scanara offers a guided DPIA (GDPR Article 35) and a guided FRIA (Article 27) as separate assessments. The FRIA pre-fills some answers from scan results. You answer; Scanara stores the results as evidence.
DPIA and FRIA reports
Scanara generates DPIA and FRIA reports from your answers and exports them as PDF, DOCX or Markdown. You review them before use.
Finding AI use in code
Scanara scans repositories for AI and ML components. This helps you build the list of AI systems you need to screen for a DPIA.
Evidence trail
Scanara versions assessment records and keeps a write-once audit log of when assessments were started, changed and exported. It does not give legal advice.
Two fine ceilings to know
EUR 10 million or 2%
GDPR ceiling for breaching DPIA obligations (Articles 35 and 83(4)): up to EUR 10 million or, for an undertaking, up to 2% of worldwide annual turnover, whichever is higher.
EUR 15 million or 3%
AI Act ceiling for provider and deployer duties: up to EUR 15 million or, for an undertaking, up to 3% of worldwide annual turnover, whichever is higher (Article 99(4)).
Questions DPOs ask
Do I need both a DPIA and a FRIA?
Not always. A DPIA is required where processing is likely to result in a high risk (GDPR Article 35). A FRIA is required of deployers of Annex III systems (except point 2) that are bodies governed by public law or private entities providing public services. It is also required of deployers of credit-scoring and life and health insurance systems (Article 27(1)).
Does Scanara replace the DPIA?
No. Scanara structures the DPIA along the four elements of GDPR Article 35(7) and stores the result. The controller stays responsible for the content and the decision.
Can I export the results?
Yes. Scanara exports DPIA and FRIA reports as PDF, DOCX or Markdown. For the FRIA, deployers notify the market surveillance authority of the results (Article 27(3)), and Scanara includes an export for that notification.
Does Scanara tell me when a DPIA is required?
No. Whether a DPIA is required depends on the processing (GDPR Article 35(3)). Scanara’s scans find AI and ML components, so you can include those systems in your DPIA screening.
Which AI Act dates matter to a DPO?
The AI literacy duty (Article 4) and the Article 5 prohibitions apply since 2 February 2025. The FRIA and the high-risk rules for Annex III systems apply from 2 December 2027 (Article 113).
Read next
See the assessments in a sample report
The demo shows an anonymised compliance report and the product walkthrough. Use it to judge whether the workflow fits your DPO work.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.