Skip to main content
Praxikon
Free check

Free case check · AI Act and GDPR

Check your AI case against the AI Act and GDPR

See whether you need a DPIA, whether there is an automated decision and which risk class your system has under the AI Act, with the legal provision. Free, no account, and your text is not stored.

PDF, Word, email or text up to 10 MB. Names are not needed for the assessment.

No case at hand? Try an example

Go to the full case check

Also in Claude: the same check inside your own AI assistant. How it works

See how it works in 27 seconds
DPIA, Article 50, FRIA · 27 seconds
Check my case

Or try this examplefree · no account

Read the film as text
  1. Made-up example. A municipality wants a model from an external supplier to calculate a risk score for every social assistance application. Residents can ask questions to a chatbot from the same supplier. The check found 11 facts in 8 sentences; sentence 7 itself says something is unknown and becomes an open question.
  2. DPIA: required, before the processing starts. Sentence 1: a score about persons, with consequences. Source: Art. 35(1) and 35(3)(a) GDPR; Dutch DPA list, category 15 Profiling.
  3. Transparency (Article 50) for the chatbot in sentence 8: applies, and already in force, since 2 August 2026. People must know at the latest at the first interaction that they are communicating with an AI system, unless this is obvious to a reasonably well-informed person. The provider designs the system that way; as deployer you check that the notice is actually there. The supplier is the provider and builds in the notice; the municipality is the deployer and checks the notice. Source: Art. 50(1) and (5) AI Act. If the municipality offers the chatbot under its own name, it can become the provider itself (Art. 3(3)). First recommendation: Place a clear notice at the chatbot that residents or customers are talking to AI, visible before the first question.
  4. Prohibition of social scoring: depends on which data count in the score. Unknown is not a no. Source: Art. 5(1)(c) AI Act. Ask the supplier and your data protection officer.
  5. High risk: likely. Social assistance falls under Annex III, point 5(a) and the system profiles persons, so the Art. 6(3) exception does not help. It is only established once the use falls exactly within that description. For a new system the obligations apply from 2 December 2027; if a public-authority system is already running before that date, Art. 111(2) applies.
  6. FRIA: likely, because the duty follows the high risk. Once that is established, the FRIA is required for a new public-authority system, before first use, built on the DPIA. Source: Art. 27(1) and (4) AI Act.
  7. The assessment: Likely high risk, DPIA required, FRIA likely, transparency obligation, possibly automated decision (Art. 22 GDPR). 16 tests, 9 recommendations, 6 open questions, 9 sources, and the DPIA and FRIA intake in Word or PDF. Law as of: 10 Oct 2026. This assessment is preparation, not legal advice.
Zahed Ashkara, lawyer, privacy and AI

Zahed Ashkara · Lawyer, privacy and AI

Certified AI Compliance Officer · member of the Dutch NEN AI & Big Data standards committee

I write the explanations and sign the deliverables.

Rather talk to a lawyer straight away? Book a call 30 min

Work with me

Rather have a lawyer handle it? There are three ways.

In your team, as your regular DPO or for one assessment. You work with me directly and know up front where you stand.

Who you hire: Zahed Ashkara, freelance AI and privacy legal adviser. Freelance only.

PRAXIKONConfidential

Classification opinion

System
Ranking of job applicants
Client role
Provider

Opinion

High-risk

art. 6 lid 2 · bijlage III, punt 4 onder a

The system ranks applicants and weighs in on selection. The Article 6(3) exception does not work: the system profiles.

Zahed Ashkaralawyer

Example, fictional system

Interim or project

Hire an AI and privacy legal adviser

Interim or per project, as privacy officer, AI governance lead or DPO. Directly or through your agency, framework agreement or hiring platform.

  • Roles: privacy officer, privacy counsel, AI governance lead, DPO or AI Act programme manager
  • AI governance and AI Act implementation in your organisation
  • Privacy advice, DPIAs, FRIAs and data processing agreements

Rate by agreementalso through your agency or framework agreement

By agreement

What you get and how it works

Monthly

External DPO and AI oversight

An independent data protection officer with fixed hours and a fixed point of contact, who also keeps your AI register and reviews new AI applications.

  • Registration as DPO with the Dutch Data Protection Authority
  • Advice on DPIAs, data breaches and data subject requests
  • Keeping the AI register and reviewing every new AI application or supplier

Fixed monthly feematched to your organisation, agreed up front

12 months, then cancellable per quarter

What you get and how it works

Fixed price up front

Signed assessment

A DPIA, FRIA, AI Act classification, Article 50 check or review of an AI contract. Fixed scope and fixed price, agreed up front.

  • A DPIA under Article 35 GDPR, with a FRIA or IAMA on the same facts where Article 27 AI Act applies
  • A classification opinion: is your system high-risk, with the reasoning per step
  • An Article 50 check for chatbots, voicebots and AI content, with notices you can publish straight away

Fixed price up frontwithin three working days of a 30-minute call

1 to 4 weeks

What you get and how it works

After a 30-minute call you have a proposal with a fixed scope and fixed price within three working days. Also through your agency or framework agreement.More about working together

AI literacy for all staff, per role and demonstrable: LearnWize

Find out yourself · free, no account

Look it up yourself, article by article

Every article of the AI Act and the GDPR, with what you must do and from when. The key articles have a decision tree that takes you to your answer in a few questions.

AI Act by articleGDPR by article

Search an article, term, ruling or fine in the GDPR and the AI Act

All obligationsFree templatesAssess one AI system in depthPraxikon in your AI assistantArticle 50 transparencyGPAI obligationsAll eight Annex III domainsAnnex III classification check

Who does the work

You work directly with the lawyer who signs.

Zahed Ashkara, lawyer, privacy and AI

Zahed Ashkara, lawyer, privacy and AI

Master’s in public law (VU) · Certified AI Compliance Officer · member of the NEN AI & Big Data committee

Wrote in AG Connect: De EU AI Act hoort niet thuis bij Legal, maar bij IT, and in Het Financieele Dagblad: Geef AI-gesprekken zelfde geheim als arts en advocaat

Opinion

A signed opinion

Not a checklist, but a reasoned opinion with my name under it. You can take it to the board, clients and the regulator.

Standards

At the standards table

As a member of the Dutch NEN standards committee on AI & Big Data, I know what ‘conformity’ will mean in practice.

Experience

Experience on the buyer’s side

At Rabobank, Sanoma and PWN I saw what organisations need to ask of their AI suppliers and their own teams.

Sources

Traceable to the article

Every finding links to the explanation on this site, with the legal provision. You do not have to take my word for it.

Rabobank

Financial sector

Independent review of the AI Act implementation across all business units, with a position paper on the risk classification of fraud detection models for the Programme Board.

PWN

Critical infrastructure

AI inventory and conformity assessment against the AI Act, the GDPR and NIS2, developed into a governance framework the organisation runs itself.

Sanoma Learning

Education, international

Ongoing adviser on AI governance: frameworks for generative AI, AI and data protection impact assessments, and decision documents for board and steering committee.

What you want to know first

What does it cost?

Fixed products have a starting price on this site. After a 30-minute call you receive a proposal with a fixed scope and price within three working days. Scoped work is not billed by the hour.

Is Praxikon still independent?

The explanations stay free, without an account and with the source for every statement. I take no commission from suppliers and sell no software. If you want someone else to do the work, you can still use everything here.

Who do I contract with?

With Embed AI (Dutch Chamber of Commerce 90283597), the business behind Praxikon. Proposal, terms and invoice are in that name.

How does an engagement work?

A 30-minute call, a fixed-price proposal within three working days, and the signed delivery after one to four weeks. After that you have thirty days for questions.

Do you work through framework agreements or agencies?

Yes. Interim work and larger programmes often run through a framework agreement or an agency. Fixed products can also be bought directly. I work exclusively as a freelancer.

Are you an attorney?

No. I am a lawyer (master’s in public law, VU Amsterdam) and a Certified AI Compliance Officer. For litigation I work with attorneys.

How does this relate to our DPO?

I work with your DPO: the DPIA and FRIA share the same facts. If you have no DPO, I can take on that role as an external DPO.

A 30-minute call

Book a 30-minute call.

I tell you honestly whether I can help, and what it costs. Within three working days you have a proposal with a fixed price.

Pick a time

Prefer email? info@embedai.nl

Praxikon is a trade name of Embed AI (Dutch Chamber of Commerce 90283597). Proposal, terms and invoice are in that name.