When DPIA is likely required
The screen that decides whether a DPIA is needed, before the assessment itself.
A DPIA is required when processing is likely to result in a high risk to rights and freedoms — and AI processing raises that likelihood by default. The practical question is which screen applies, and running it before go-live is cheaper than running it after an incident.
The screen
Special categories, automated decisions with legal effect, systematic monitoring, and scale are the usual triggers. AI go-lives trip at least one of them more often than teams expect.
Why AI raises the likelihood
Models generalise from personal data at scale, and their outputs affect people. The Regulation's deployer-side DPIA duty exists precisely because "the vendor did a DPIA" does not answer the question about your deployment.
What the starter covers
Readiness themes, the special-category flags the facts support, and the evidence gaps — the difference between a DPIA you complete and a DPIA you assume is handled.
How the tool frames it
It screens the processing you describe and drafts the starter themes. The DPO and counsel still close the assessment.
Decision-support drafting only — not legal advice. Confirm the duty set against the current consolidated text of Regulation (EU) 2024/1689.