# Standards — Combined DPIA and AI Act Conformity Assessment

## Primary Legislation
- **GDPR Art. 35**: DPIA requirements — Art. 35(7)(a)-(d) minimum content.
- **GDPR Art. 36**: Prior consultation when residual risk is high.
- **AI Act Art. 9**: Risk management system for high-risk AI.
- **AI Act Art. 10-15**: Data governance, documentation, transparency, human oversight, accuracy requirements.
- **AI Act Art. 26(9)**: Deployers must use DPIA results for AI Act compliance.
- **AI Act Art. 43**: Conformity assessment procedures.
- **AI Act Art. 72**: Post-market monitoring obligations.

## EDPB Guidance
- **WP248rev.01**: DPIA methodology and nine criteria for high-risk determination.
- **EDPB Guidelines 04/2025**: AI-specific DPIA requirements.

## Technical Standards
- **ISO/IEC 42001:2023**: AI management system — Annex B risk assessment methodology.
- **ISO/IEC 23894:2023**: AI risk management guidance.
- **ISO/IEC 29134:2023**: Privacy impact assessment guidelines.
- **ISO 31000:2018**: Risk management framework referenced by both DPIA and AI Act risk assessment.