# Combined Assessment Workflows

## Workflow 1: Combined DPIA + Conformity Assessment

```
START: High-risk AI system requires both GDPR DPIA and AI Act conformity assessment
│
├─ Phase 1: Scoping (Days 1-5)
│  ├─ Confirm AI Act high-risk classification (Art. 6 + Annex III)
│  ├─ Confirm DPIA obligation (Art. 35 triggers)
│  ├─ Assemble combined assessment team (privacy + AI safety + legal + engineering)
│  └─ Define scope covering both GDPR and AI Act dimensions
│
├─ Phase 2: AI System Description (Days 6-15)
│  ├─ GDPR Art. 35(7)(a): Systematic processing description
│  ├─ AI Act Art. 11: Technical documentation requirements
│  ├─ Training data governance (Art. 10)
│  ├─ Model architecture and capabilities
│  └─ Deployment context and affected data subjects
│
├─ Phase 3: Necessity and Proportionality (Days 16-20)
│  ├─ GDPR: Data minimisation, purpose limitation, lawful basis
│  ├─ AI Act: Intended purpose, foreseeable misuse, scope limitations
│  └─ Assessment of alternatives to AI
│
├─ Phase 4: Transparency and Oversight (Days 21-25)
│  ├─ GDPR Arts. 13-14: Privacy notice, logic explanation
│  ├─ AI Act Art. 13: Interpretability, instructions for use
│  ├─ AI Act Art. 14: Human oversight design
│  ├─ GDPR Art. 22: Automated decision-making assessment
│  └─ AI Act Art. 50: AI interaction notification
│
├─ Phase 5: Combined Risk Assessment (Days 26-35)
│  ├─ GDPR privacy risks: extraction, inference, bias, inaccuracy
│  ├─ AI Act safety risks: reliability, robustness, cybersecurity
│  ├─ Fundamental rights risks: discrimination, privacy, dignity
│  ├─ Apply combined risk scoring matrix
│  └─ Generate combined risk register
│
├─ Phase 6: Mitigation Measures (Days 36-42)
│  ├─ Technical measures addressing both GDPR and AI Act risks
│  ├─ Organisational measures
│  ├─ Residual risk assessment
│  └─ Prior consultation assessment (Art. 36 GDPR)
│
├─ Phase 7: Quality Management (Days 43-46)
│  ├─ AI Act Art. 17: Quality management system documentation
│  ├─ Monitoring and logging requirements (Art. 12)
│  ├─ Post-market monitoring plan (Art. 72)
│  └─ Periodic review schedule
│
├─ Phase 8: Approval (Days 47-52)
│  ├─ DPO review and advice
│  ├─ AI governance board review
│  ├─ Senior management approval
│  ├─ Conformity declaration (AI Act Art. 47)
│  └─ EU database registration (AI Act Art. 49, if applicable)
│
└─ END: Combined assessment registered. Next review at retraining or 12 months.
```