# Combined DPIA + AI Act Conformity Assessment Template

## Organisation: Cerebrum AI Labs
## Reference: CDPIA-2026-___

---

## SECTION 1: SYSTEM IDENTIFICATION
| Field | Value |
|-------|-------|
| AI System Name | |
| AI Act Classification | High-risk (Annex III category: ___) |
| GDPR DPIA Trigger | Art. 35(3)(a)/(b)/(c) / WP248 criteria |
| Assessment Date | |
| Version | 1.0 |

## SECTION 2: AI SYSTEM DESCRIPTION (GDPR Art. 35(7)(a) + AI Act Art. 11)
[Describe: purpose, model type, training data, deployment context, data subjects, data flow]

## SECTION 3: NECESSITY AND PROPORTIONALITY (GDPR Art. 35(7)(b))
| Question | Response |
|----------|----------|
| AI necessary for stated purpose? | |
| Alternatives assessed? | |
| Data minimisation applied? | |
| Lawful basis for training | |
| Lawful basis for inference | |

## SECTION 4: TRANSPARENCY AND OVERSIGHT (GDPR Arts. 13-14, 22 + AI Act Arts. 13-14, 50)
| Element | Implemented? | Details |
|---------|-------------|---------|
| Privacy notice AI section | Yes/No | |
| AI interaction notification | Yes/No | |
| Logic explanation mechanism | Yes/No | |
| Human oversight design | Yes/No | Level: |
| Art. 22 safeguards | Yes/No/N/A | |

## SECTION 5: COMBINED RISK REGISTER

### Risk Scoring Matrix
| Dimension | Score (1-5) | Weight | Weighted | Key Findings |
|-----------|------------|--------|----------|-------------|
| Privacy risk | | 30% | | |
| Fundamental rights | | 25% | | |
| Accuracy & reliability | | 20% | | |
| Transparency gap | | 15% | | |
| Oversight adequacy | | 10% | | |
| **Total** | | **100%** | **___** | |

**Classification**: Low / Medium / High / Very High / Critical

## SECTION 6: MITIGATION MEASURES (GDPR Art. 35(7)(d) + AI Act Art. 9)
| Risk | Measure | Type | Owner | Status | Residual Score |
|------|---------|------|-------|--------|---------------|
| | | Technical/Org | | | |

## SECTION 7: QUALITY MANAGEMENT (AI Act Art. 17)
| Element | Status |
|---------|--------|
| Monitoring system | |
| Logging requirements | |
| Post-market monitoring plan | |
| Incident response procedure | |

## SECTION 8: APPROVAL
| Role | Name | Date |
|------|------|------|
| System Owner | | |
| DPO | | |
| AI Governance Board | | |
| Senior Management | | |

| | |
|---|---|
| Prior Consultation Required? | Yes / No |
| Conformity Declaration Issued? | Yes / No |
| EU Database Registration | Yes / No — Reference: |
| Next Review Date | |