Praxikon Dossier · case check
Upload a case. Get a reasoned assessment under the GDPR and the AI Act.
Describe a system, project or supplier. Praxikon extracts the facts, you confirm them, and then you see per test the outcome next to the article, guideline or ruling it rests on. With recommendations and the questions you still need to ask.
- GDPR and AI Act in one assessment
- A source for every conclusion
- Your text is not stored
- Fixed rules, no AI model
- Free, no account
- 01 Case
- 02 Confirm facts
- 03 Assessment
Drag your case here
PDF, Word, email or text · up to 10 MB
Remove names and other identifying details if you can: they are not needed for the assessment.
In 25 seconds
See how it works
An invented case of a municipality, from upload to case file.
- Upload
- Facts
- Assessment
- Sources
- Case file
and
signed
How it works
From case to reasoned case file in four steps
The system does the groundwork that would otherwise take a privacy or AI lawyer hours. You stay in control: whatever is not in the case becomes a question, never an assumption.
- 01
Upload
A project plan, an email, a supplier contract or a few sentences of text.
- 02
Facts
Every fact with the sentence it comes from. If something is missing, it stays unknown.
- 03
Assessment
Per test under the GDPR and the AI Act: the outcome, the reasoning, the source and how certain it is.
- 04
Case file
Recommendations in order, open questions per person, and the basis for your DPIA and FRIA.
Example
What an assessment looks like
Invented cases from five domains, each with a different outcome. The assessment below comes from the same rules as the check. Choose a domain.
case-municipality-benefits.docx
Risk score for social assistance applications
A municipality wants to use a model that calculates a risk score for unlawfulness on every social assistance application. Applications with a high score receive an additional investigation by an enforcement officer. The model uses data on income, housing situation and previous applications, for about 3,000 applications per year. Whether postcode, nationality or other characteristics that may indirectly discriminate count in the score is not known.
Facts found
- Government or public body
- Deployer
- AI system
- Data about people
- Benefits and public services
- Score or prediction about persons
- Effect on the data subject
- Decision without meaningful human assessment
- Large scale or systematic
- Unknown: becomes an open question
Assessment
High risk, DPIA and FRIA required, automated decision (Art. 22 GDPR)
- AI ActProhibition of social scoringTest against Art. 5(1)(c)Art. 5(1)(c) · AI ActDepends on
- AI ActYour role under the AI ActDeployerArt. 3(3) and (4) · AI ActApplies
- AI ActHigh risk: public services and benefitsAnnex III, point 5(a), and the system profiles personsAnnex III, point 5(a) · AI ActLikely
- AI ActObligations as deployerArt. 26, from 2 December 2027Art. 26(1), (2), (4), (5), (6), (7) and (11) · AI ActLikely
- AI ActRegistration in the EU databasePublic authorities register the useArt. 26(8) · AI ActLikely
- AI ActFRIA (fundamental rights impact assessment)A public authority is a body governed by public lawArt. 27(1) · AI ActRequired
- GDPRDPIARequired before the processing startsArt. 35(1) · GDPRRequired
- GDPRLegal basisLessons from the SyRI rulingArt. 6(1)(c) and (e), and Art. 6(3) · GDPRDepends on
- GDPRAutomated decisionArt. 22, solely automated with significant effectArt. 22(1) to (3) · GDPRLikely
- GDPRExplanation of the logicArt. 13(2)(f) and Art. 15(1)(h)Art. 13(2)(f) · GDPRApplies
Recommendations
What to do now, in order
- 01Start the DPIA before the processing begins and involve your data protection officer.
- 02Make sure a human can assess and change every decision on its merits, or record the exception of Art. 22(2) and the safeguards.
- 03Plan the FRIA before the first use, by 2 December 2027 at the latest, and build it on the DPIA.
- 04Set up human oversight by people who understand the system and can override the outcome, and agree with the supplier which logs and usage information you receive.
- 05Update the privacy notice and the information for data subjects before the system goes live.
Open questions
What is still missing, and who to ask
- Which data count in the score, and do they come from a context other than the application itself?Ask: The supplier and your data protection officer
- Which legal provision is the use of this system based on?Ask: Your lawyer or data protection officer
- Can data in the model, such as neighbourhood or household composition, act as a proxy for a person's origin? Has it been tested for unequal outcomes between groups?Ask: The supplier and your data protection officer
- Does it involve special categories of personal data (health, biometrics, racial or ethnic origin, religion, political opinion, trade union membership, sex life)?Ask: Your data protection officer
- Do people talk directly with the system, does it create content or does it recognise emotions?Ask: The supplier or the development team
The report
A case file you can show
The assessment is the intake for your DPIA and FRIA: with the facts, the tests, the sources and the open questions. For now you print it or save it as a PDF; a Word export will follow. If you want certainty, a lawyer reviews it and signs off.
- ✓ Sources link to EUR-Lex, the EDPB, the Dutch Data Protection Authority and case law
- ✓ The date of the legal text the assessment rests on, so it can be checked later
- ✓ Coming soon in Praxikon Dossier: a notice when the law or a guideline changes and affects your case file
Honest about the limits
What the case check is and is not
It is
- A fast, reasoned first assessment
- The tests that apply to your case, under the GDPR and the AI Act
- A source for every conclusion, so you can check it
- The questions you still need to answer
It is not
- Legal advice: for that, a lawyer reviews it
- An assessment of facts that are not in the case
- Storage of your text or training of AI models on it
- A replacement for the DPIA or FRIA itself: it is the intake for it
Frequently asked questions
Before you upload
What happens to my case?
Your case is read and assessed in your own browser. If you upload a file, it only goes briefly to our server in the EU to extract the text; it is not stored. Your text is not saved anywhere. Remove names and other identifying details if you can: they are not needed for the assessment.
What does Praxikon keep?
To improve the check, we keep per assessment, anonymously, which answers were pre-filled, which ones you changed and which outcomes resulted, plus your thumbs up or down if you give one. These are only choices from fixed lists, such as "domain: recruitment". No text, no file name, no IP address and no cookie.
Which sources does Praxikon use?
The GDPR and the AI Act as amended by the Digital Omnibus (Regulation (EU) 2026/1744), EDPB guidelines, the DPIA list of the Dutch Data Protection Authority, and rulings of the Court of Justice and Dutch courts. Every conclusion links to its source.
Does the case check use AI?
No. The case is read with fixed rules and the assessment comes from fixed rules. As a result, the same answers always give the same assessment, and no AI model looks at your case.
How certain is the assessment?
Each test shows how certain the outcome is. If the assessment depends on a missing fact, it says "depends on" with the question that decides it. Praxikon never fills anything in by itself.
Is this legal advice?
No. It is preparation that makes your own judgement, or that of your lawyer, faster and better. If you want a lawyer to review it and sign off the case file, that is possible.
What does it cost?
The case check is free. For professionals who want to keep case files, update them when the law changes and share them with their team, Praxikon Dossier is coming.
Try it with your own case
Free, no account, and your text is not stored.
Praxikon is a trade name of Embed AI. The assessment is preparation, not legal advice. Legal references as of 8 October 2026.