Article 35 GDPR requires a data protection impact assessment where processing is likely to result in a high risk. Many AI use cases meet that threshold through profiling, large-scale processing or new technology. The problem is not whether to do a DPIA; it is that most templates do not ask the questions that matter for a model.
Start with the system, not the form
Describe the feature as an engineer would: inputs, model, outputs, where outputs go and who acts on them. Include the vendor, hosting region and whether the model is fine-tuned on your data. A diagram beats three pages of prose.
Data lineage
For each data set (training, fine-tuning, evaluation, prompts, outputs, logs) record source, lawful basis, retention and whether it is used to improve the model. "Used for improvement" is where most vendor surprises hide.
Output risks
Classic DPIAs assess risks to data in storage. AI DPIAs must also assess risks from what the model produces: inaccurate inferences about people, discriminatory outcomes, confabulated facts presented as true, and leakage of training data in outputs. Rate likelihood and severity for each.
Human oversight and Article 22
If outputs lead to decisions with legal or similarly significant effects, you need either a valid exception under Article 22 or meaningful human involvement. "A human clicks approve" is not meaningful oversight unless the human can and does disagree. Document the review step, the reviewer's competence and the override rate.
Model change control
A DPIA is a snapshot; a model is not. Define what counts as a material change (new model version, new data source, new use case) and who re-opens the DPIA when it happens. Tie this to your AI Act documentation if the system is high-risk.
Measures that actually reduce risk
Prefer measures you can verify: input filtering, output logging with retention limits, rate limits on sensitive queries, evaluation sets for bias, and a documented incident path. Avoid "we will take appropriate measures".
Consultation
Involve the DPO if you have one, and consider consulting affected users or their representatives for high-impact features. Where residual risk remains high, prior consultation with the supervisory authority (Article 36) is required.
If you would like a DPIA structure that engineering and legal teams can both use, get in touch.