DPIA Triggers Specific to an AI System

“We are using AI” is not a DPIA trigger and never was. The test in Article 35 is about the processing, not the technique — but several things AI systems routinely do land squarely inside it, and one of the nine screening criteria names new technology explicitly.

The three cases in Article 35(3)

Article 35(1) of Regulation (EU) 2016/679 sets the general rule: where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller must carry out a data protection impact assessment before the processing. Article 35(3) then gives three cases where a DPIA is required “in particular” — that is, a non-exhaustive list of things always taken to clear the bar:

• 35(3)(a) — a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the person or similarly significantly affect them.
• 35(3)(b) — processing on a large scale of the special categories of data in Article 9(1), or of criminal conviction and offence data under Article 10.
• 35(3)(c) — systematic monitoring of a publicly accessible area on a large scale.

Note what 35(3)(a) requires and what it does not. It needs both the evaluation and a decision built on it that has legal or similarly significant effect. Scoring people and doing nothing consequential with the score does not satisfy (a) on its own — though it may well satisfy the general 35(1) test by another route. The definition of that effect threshold is the same one that governs Article 22, and it is worked through on what counts as a solely automated decision.

The nine criteria, read against AI

The list in 35(3) is short and the general test in 35(1) is abstract, so the operative screening tool in practice is the nine-criteria list in the Article 29 Working Party’s Guidelines on Data Protection Impact Assessment (WP248 rev.01), endorsed by the EDPB at its first plenary in May 2018. The guidelines’ rule of thumb is that processing meeting two or more criteria will in most cases require a DPIA; meeting one may still do so.

• Evaluation or scoring, including profiling and predicting. Any model that produces a per-person output — a propensity, a risk band, a suitability rating — meets this.
• Automated decision-making with legal or similar significant effect. Narrower than the first; needs the consequence.
• Systematic monitoring. Observation or control of data subjects, particularly where they cannot avoid it.
• Sensitive data or data of a highly personal nature. Broader than Article 9: the guidelines include things like financial data and location, on the basis that they exceed reasonable expectations.
• Data processed on a large scale.
• Matching or combining datasets originating from separate operations, in a way exceeding the data subject’s reasonable expectations.
• Data concerning vulnerable data subjects — children, employees, patients, anyone in an imbalance of power with the controller.
• Innovative use, or applying new technological or organisational solutions.
• Processing that prevents data subjects from exercising a right or using a service or a contract.

The eighth is the one people reach for first when the subject is AI, and it is the one to lean on least. “New technology” is a criterion because novelty means the risks are less well understood, not because novelty is itself harmful; in 2026 a retrieval-augmented chatbot over your own documentation is not innovative in any sense the guidelines had in mind. The criteria that usually do the real work on an AI system are the first, the fifth, the sixth and the seventh — scoring, scale, combination and vulnerability.

Six AI scenarios, scored

A CV-screening model ranking applicants

Evaluation and scoring, vulnerable data subjects (candidates are in a clear power imbalance), and very likely automated decision-making with significant effect depending on how the shortlist is used. Three or four criteria, plus a strong 35(3)(a) argument. A DPIA is required, and the sector-specific obligations on AI in hiring attach on top of it.

An internal support chatbot over your own ticket archive

Large scale is arguable; the tickets contain third-party personal data the writers did not expect to be reused, so combination and reasonable expectations are in play. The stronger question is not the DPIA trigger but the compatibility test for the reuse itself, covered on purpose limitation and reusing customer data. Often a DPIA is warranted; the assessment is short.

A generative feature that summarises a user’s own documents

If the user supplies the document and gets the summary back, there is no evaluation of a person, no decision, no monitoring. Scale may be large, but scale alone is one criterion. This is a genuine candidate for “screen, record the reasoning, do not run a full DPIA” — provided the documents are not routinely special-category, which in a health or legal product they will be.

Emotion or sentiment inference from voice or video

Highly personal data, systematic monitoring, and depending on the context vulnerable subjects. This is a DPIA on the GDPR side regardless, and under the AI Act some uses in workplace and education contexts are prohibited outright — see the emotion recognition ban.

Fine-tuning on customer conversation logs

Large scale, combination of datasets collected for a different purpose, and the reasonable-expectations point. Two criteria at minimum.

Content moderation ranking user posts

Evaluation, systematic monitoring, and processing that can prevent a data subject from using a service — the ninth criterion, which is frequently forgotten and is exactly on point when an automated classifier can suspend an account.

Your own authority’s list

Article 35(4) requires each supervisory authority to publish a list of the kinds of processing for which a DPIA is mandatory in its jurisdiction, and 35(5) permits an optional list of processing for which one is not. These lists went through the consistency mechanism and the EDPB issued an opinion on each; they are collected on the EDPB’s consistency opinions register. They are not identical between Member States, and several name AI or profiling patterns directly. If you operate in more than one Member State, the practical rule is that the strictest applicable list governs your screening.

When the answer is genuinely no

A screening that always says yes is not a screening. Article 35 requires a DPIA where processing is likely to result in a high risk, and a system that touches personal data lightly, produces no per-person judgement, and does nothing consequential with its output does not meet that. Using a model to translate a public help page, to generate non-personalised marketing copy, or to classify inbound mail by topic rather than by sender are all ordinary processing operations that happen to use a model.

What the accountability principle in Article 5(2) does require is that you can show you asked. Record the screening: the criteria you considered, the ones you concluded did not apply, and why. A one-page negative screening record is cheap and it is the document a supervisory authority asks for when it wants to know whether Article 35 was considered at all.

The timing rule everyone breaks

Article 35(1) says prior to the processing. In practice DPIAs are written after the feature is built, when the design decisions the assessment is supposed to influence have already been made. That is not only a compliance problem — it is what makes the document useless, because the section on measures to address the risks becomes a description of what was already shipped.

Two further timing points are easy to miss. Article 35(2) requires you to seek the advice of your data protection officer where one is designated, so the DPIA question and the question of whether you need a DPO arrive together. And Article 35(11) requires review where there is a change in the risk — for a model-backed feature, swapping the underlying model, adding a data source, or extending the feature to a new user population are all changes that should send you back to the document. Article 36 then requires prior consultation with the supervisory authority where the DPIA indicates that the residual risk remains high after mitigation, which is a real possibility for some profiling systems and a step with its own timetable.