사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill ai-privacy-impact-template시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
Combined DPIA and AI Act Conformity Assessment Template
Overview
High-risk AI systems under the EU AI Act must undergo both a GDPR Art. 35 DPIA and an AI Act conformity assessment. Rather than conducting these as separate exercises, this skill provides an integrated template that satisfies both frameworks simultaneously. The combined assessment ensures consistency between GDPR privacy risk analysis and AI Act safety and fundamental rights evaluation, reduces duplication, and provides a single risk scoring matrix covering both regulatory dimensions. Art. 26(9) AI Act explicitly requires deployers to use DPIA results when fulfilling AI Act obligations.
Combined Risk Scoring Matrix
Risk Dimensions
| Dimension | Source | Weight |
|---|---|---|
| Privacy risk to data subjects | GDPR Art. 35(7)(c) | 30% |
| Fundamental rights impact | EU AI Act Art. 9(2)(a) | 25% |
| Accuracy and reliability risk | EU AI Act Art. 15 | 20% |
| Transparency and explainability gap | GDPR Art. 13(2)(f) + AI Act Art. 13 | 15% |
| Human oversight adequacy | GDPR Art. 22 + AI Act Art. 14 | 10% |
Scoring Scale (Per Dimension)
| Score | Level | Description |
|---|---|---|
| 1 | Minimal | Risk negligible; controls effective |
| 2 | Low | Minor risk; standard controls sufficient |
| 3 | Medium | Moderate risk; enhanced controls needed |
| 4 | High | Significant risk; intensive mitigation required |
| 5 | Critical | Severe risk; may require processing suspension |
Overall Risk Classification
| Weighted Score | Classification | Action Required |
|---|---|---|
| 1.0-1.5 | Low | Standard monitoring |
| 1.6-2.5 | Medium | Enhanced monitoring and periodic review |
| 2.6-3.5 | High | Active mitigation and DPO/Board oversight |
| 3.6-4.5 | Very High | Art. 36 prior consultation; deployment hold pending mitigation |
| 4.6-5.0 | Critical | Do not deploy; fundamental redesign required |
GDPR DPIA Requirements (Art. 35(7))
| Element | Reference | Combined Assessment Section |
|---|---|---|
| Systematic description of processing | Art. 35(7)(a) | Section 2: AI System Description |
| Necessity and proportionality | Art. 35(7)(b) | Section 3: Necessity Assessment |
| Risk assessment | Art. 35(7)(c) | Section 5: Combined Risk Register |
| Mitigation measures | Art. 35(7)(d) | Section 6: Mitigation Measures |
AI Act Conformity Assessment Requirements
For high-risk AI systems (Annex III), the conformity assessment per Art. 43 requires:
| Element | Reference | Combined Assessment Section |
|---|---|---|
| Risk management system | Art. 9 | Section 5: Combined Risk Register |
| Data governance | Art. 10 | Section 2: Training Data Governance |
| Technical documentation | Art. 11 | Full combined assessment document |
| Record-keeping | Art. 12 | Section 7: Monitoring and Logging |
| Transparency | Art. 13 | Section 4: Transparency Assessment |
| Human oversight | Art. 14 | Section 4: Human Oversight |
| Accuracy, robustness, cybersecurity | Art. 15 | Section 5: Technical Risk Assessment |
| Quality management system | Art. 17 | Section 8: Quality Management |
Mitigation Measures Framework
Technical Measures
| Measure | GDPR Relevance | AI Act Relevance | Priority |
|---|---|---|---|
| Differential privacy | Training data protection | Robustness (Art. 15) | High for sensitive data |
| Model output perturbation | Model inversion protection | Accuracy trade-off (Art. 15) | Medium |
| Fairness constraints | Non-discrimination (Art. 5(1)(a)) | Bias prevention (Art. 10) | High for high-risk |
| Explainability tools (SHAP/LIME) | Art. 13(2)(f) logic explanation | Interpretability (Art. 13) | High |
| Input/output PII filtering | Data minimisation (Art. 5(1)(c)) | Accuracy (Art. 15) | High for generative AI |
| Encryption (rest/transit) | Security (Art. 32) | Cybersecurity (Art. 15) | Standard |
| Access controls (RBAC) | Security (Art. 32) | Cybersecurity (Art. 15) | Standard |
| Anomaly detection | Breach detection (Art. 33) | Robustness (Art. 15) | Medium |
Organisational Measures
| Measure | GDPR Relevance | AI Act Relevance |
|---|---|---|
| AI ethics review board | Accountability (Art. 5(2)) | Quality management (Art. 17) |
| Model cards | Transparency (Art. 13-14) | Technical documentation (Art. 11) |
| Regular bias audits | Fairness (Art. 5(1)(a)) | Bias monitoring (Art. 10) |
| Incident response for AI | Breach notification (Art. 33-34) | Post-market monitoring (Art. 72) |
| Staff training on AI risks | Accountability | Human oversight (Art. 14) |
| Documentation and record-keeping | Accountability (Art. 5(2)) | Record-keeping (Art. 12) |
Enforcement Relevance
- AI Act Art. 26(9): Deployers of high-risk AI shall use GDPR Art. 35 DPIA information when fulfilling AI Act obligations — the combined assessment implements this requirement.
- AI Act Art. 43: Conformity assessment procedures for high-risk AI systems.
- GDPR Art. 35: DPIA requirements — the combined template satisfies all Art. 35(7) elements.
Integration Points
- ai-dpia: Combined template extends the AI DPIA methodology
- ai-act-high-risk-docs: Conformity assessment documentation aligns with high-risk requirements
- ai-bias-special-category: Bias assessment results feed into combined risk register
- ai-automated-decisions: Human oversight assessment integrates Art. 22 and Art. 14 requirements
