Praxikon Dossier · case check
Free AI Act and GDPR check for your AI use case
Made by Zahed Ashkara, AI and privacy legal adviserUpdated on
Tested against the AI Act as amended by Regulation (EU) 2026/1744, the final text published in the Official Journal on 24 July 2026, and against the GDPR.
How do you quickly assess whether your AI application falls under the GDPR and the AI Act?
Your application falls under the GDPR as soon as it processes personal data (Article 2 GDPR), and under the AI Act if it is an AI system (Article 3(1)) that is placed on the market, put into service or used in the EU (Article 2 AI Act); its purpose then decides whether it can be high risk, for example in recruitment or credit scoring (Annex III). Describe your application below in a few sentences, and the check tests both laws step by step, with the source for every outcome.
Describe a system, project or supplier. Praxikon extracts the facts, you confirm them, and then you see per test the outcome next to the article, guideline or ruling it rests on. With recommendations and the questions you still need to ask.
- GDPR and AI Act in one assessment
- A source for every conclusion
- Your text is not stored
- Fixed rules, no AI model
- Free, no account
- 01 Case
- 02 Confirm facts
- 03 Assessment
Drag your case here
PDF, Word, email or text · up to 10 MB
Remove names and other identifying details if you can: they are not needed for the assessment.
In 27 seconds
See what the answer looks like
A made-up municipality case: first what already applies (DPIA, transparency for the chatbot under Article 50), then what comes in 2027 (high risk, FRIA). Each verdict with the sentence from the case and the article it rests on.
Read the film as text
- Made-up example. A municipality wants a model from an external supplier to calculate a risk score for every social assistance application. Residents can ask questions to a chatbot from the same supplier. The check found 11 facts in 8 sentences; sentence 7 itself says something is unknown and becomes an open question.
- DPIA: required, before the processing starts. Sentence 1: a score about persons, with consequences. Source: Art. 35(1) and 35(3)(a) GDPR; Dutch DPA list, category 15 Profiling.
- Transparency (Article 50) for the chatbot in sentence 8: applies, and already in force, since 2 August 2026. People must know at the latest at the first interaction that they are communicating with an AI system, unless this is obvious to a reasonably well-informed person. The provider designs the system that way; as deployer you check that the notice is actually there. The supplier is the provider and builds in the notice; the municipality is the deployer and checks the notice. Source: Art. 50(1) and (5) AI Act. If the municipality offers the chatbot under its own name, it can become the provider itself (Art. 3(3)). First recommendation: Place a clear notice at the chatbot that residents or customers are talking to AI, visible before the first question.
- Prohibition of social scoring: depends on which data count in the score. Unknown is not a no. Source: Art. 5(1)(c) AI Act. Ask the supplier and your data protection officer.
- High risk: likely. Social assistance falls under Annex III, point 5(a) and the system profiles persons, so the Art. 6(3) exception does not help. It is only established once the use falls exactly within that description. For a new system the obligations apply from 2 December 2027; if a public-authority system is already running before that date, Art. 111(2) applies.
- FRIA: likely, because the duty follows the high risk. Once that is established, the FRIA is required for a new public-authority system, before first use, built on the DPIA. Source: Art. 27(1) and (4) AI Act.
- The assessment: Likely high risk, DPIA required, FRIA likely, transparency obligation, possibly automated decision (Art. 22 GDPR). 18 tests, 9 recommendations, 6 open questions, 10 sources, and the DPIA and FRIA intake in Word or PDF. Law as of: 10 Oct 2026. This assessment is preparation, not legal advice.
How it works
From case to reasoned case file in four steps
The system does the groundwork that would otherwise take a privacy or AI lawyer hours. You stay in control: whatever is not in the case becomes a question, never an assumption.
- 01
Upload
A project plan, an email, a supplier contract or a few sentences of text.
- 02
Facts
Every fact with the sentence it comes from. If something is missing, it stays unknown.
- 03
Assessment
Per test under the GDPR and the AI Act: the outcome, the reasoning, the source and how certain it is.
- 04
Case file
Recommendations in order, open questions per person, and the basis for your DPIA and FRIA.
Example
What an assessment looks like
Invented cases from five domains, each with a different outcome. The assessment below comes from the same rules as the check. Choose a domain.
case-municipality-benefits.docx
Risk score for social assistance applications
A municipality wants to use a model that calculates a risk score for unlawfulness on every social assistance application. Applications with a high score receive an additional investigation by an enforcement officer. The model uses data on income, housing situation and previous applications, for about 3,000 applications per year. Whether postcode, nationality or other characteristics that may indirectly discriminate count in the score is not known.
Facts found
- Government or public body
- Deployer
- AI system
- Data about people
- Benefits and public services
- Score or prediction about persons
- Effect on the data subject
- Decision without meaningful human assessment
- Large scale or systematic
- Unknown: becomes an open question
Assessment
Likely high risk, DPIA required, FRIA likely, possibly automated decision (Art. 22 GDPR)
- AI ActDoes the AI Act apply?AI system: infers by itself how to reach an outcomeArt. 3(1) · AI ActApplies
- AI ActProhibition of social scoringTest Art. 5(1)(c) first: a prohibition comes before the restArt. 5(1)(c) · AI ActDepends on
- AI ActYour role under the AI ActDeployerArt. 3(3) and (4) · AI ActApplies
- AI ActHigh risk: public services and benefitsAnnex III, point 5(a), and the system profiles personsAnnex III, point 5(a) · AI ActLikely
- AI ActObligations as deployerArt. 26, use of a high-risk systemArt. 26(1), (2), (4), (5), (6) and (11) · AI ActLikely
- AI ActRegistration in the EU databasePublic authorities register the use. Art. 49 applies since 2 August 2026, but only gains an object once the system counts as an Annex III high-risk system from 2 December 2027Art. 26(8) · AI ActLikely
- AI ActFRIA (fundamental rights impact assessment)A public authority is a body governed by public lawArt. 27(1) · AI ActLikely
- GDPRDPIARequired before the processing startsArt. 35(1) · GDPRRequired
- GDPRLegal basisLessons from the SyRI rulingArt. 6(1)(c) and (e), and Art. 6(3) · GDPRDepends on
- GDPRAutomated decisionArt. 22, solely automated with significant effectArt. 22(1) to (3) · GDPRLikely
- GDPRExplanation of the logicArt. 13(2)(f) and Art. 15(1)(h)Art. 13(2)(f) · GDPRApplies
- GDPRGDPR principlesFair and transparent, only the data needed, limited storageArt. 5(1)(a) · GDPRApplies
- GDPRData protection officerMandatory for a public authorityArt. 37(1)(a) · GDPRRequired
- AI ActRight to explanation (Art. 86 AI Act)In addition to the GDPR: for this automated decision, Art. 15(1)(h) GDPR already gives a right to an explanation. Art. 86 applies since 2 August 2026, but can only be invoked once the system counts as an Annex III high-risk system from 2 December 2027.Art. 86(1) and (3) · AI ActApplies
- GDPRIndirect discrimination through proxy characteristicsTo be assessed in the DPIA and, where it applies, in the FRIA. Bias test with special category data: possible under Art. 4a AI Act, if strictly necessary and with safeguards.Art. 9(1) and (2) · GDPRDepends on
Recommendations
What to do now, in order
- 01Start the DPIA before the processing begins and involve your data protection officer.
- 02Make sure a human can assess and change every decision on its merits, or record the exception of Art. 22(2) and the safeguards.
- 03Set up the human oversight required by the AI Act so that it can also carry the human intervention of Art. 22(3) GDPR: someone who assesses the decision on its merits and can change it. A sign-off without a real assessment does not count.
- 04Carry out the FRIA before the first use and build it on the DPIA. If the system goes into use from 2 December 2027, do it before that first use; if it was already in use earlier, before a significant change in its design or intended purpose, and by 2 August 2030 at the latest if the system is intended to be used by public authorities.
- 05Run the DPIA and the FRIA as one process. Ask the provider for the instructions for use now: the GDPR requires the DPIA before the processing, and Art. 26(9) AI Act makes the use of that information for the DPIA mandatory from 2 December 2027, and for a system already in use before then under Art. 111(2). Refer in the FRIA to the parts of the DPIA that already cover a FRIA obligation (Art. 27(4) AI Act).
Open questions
What is still missing, and who to ask
- Which data count in the score, do they come from a context other than the one in which they were collected, and is the detrimental consequence proportionate to the behaviour?Ask: The supplier and your data protection officer
- Which legal provision is the use of this system based on?Ask: Your legal team or data protection officer
- Can data in the model, such as neighbourhood or household composition, act as a proxy for a person's origin? Has it been tested for unequal outcomes between groups?Ask: The supplier and your data protection officer
- Was the system put into service or placed on the market before 2 December 2027?Ask: The process owner or the supplier
- For how long and how often is the system used?Ask: The process owner
The report
A case file you can show
The assessment is the intake for your DPIA and FRIA: with the facts, the tests, the sources and the open questions. You receive both as Word files by email, or download them straight away if you came through your AI assistant; you can save the assessment itself as a PDF. If you want certainty, a legal adviser reviews it and signs off.
- ✓ Sources link to EUR-Lex, the EDPB, the Dutch Data Protection Authority and case law
- ✓ The date of the legal text the assessment rests on, so it can be checked later
- ✓ A notice when the law or a guideline changes and affects your outcome, if you ask for the report by email
Honest about the limits
What the case check is and is not
It is
- A fast, reasoned first assessment
- The tests that apply to your case, under the GDPR and the AI Act
- A source for every conclusion, so you can check it
- The questions you still need to answer
It is not
- Legal advice: for that, a legal adviser reviews it
- An assessment of facts that are not in the case
- Storage of your text or training of AI models on it
- A replacement for the DPIA or FRIA itself: it is the intake for it
Frequently asked questions
Before you upload
What happens to my case?
Your case is read and assessed in your own browser. If you upload a file, it only goes briefly to our server in the EU to extract the text; it is not stored. Your text is not saved anywhere. Remove names and other identifying details if you can: they are not needed for the assessment.
What does Praxikon keep?
To improve the check, we keep per assessment, anonymously, which answers were pre-filled, which ones you changed and which outcomes resulted, plus your thumbs up or down if you give one. These are only choices from fixed lists, such as "domain: recruitment". No text, no file name, no IP address and no cookie.
Which sources does Praxikon use?
The GDPR and the AI Act as amended by the Digital Omnibus (Regulation (EU) 2026/1744), EDPB guidelines, the DPIA list of the Dutch Data Protection Authority, and rulings of the Court of Justice and Dutch courts. Every conclusion links to its source.
Does the case check use AI?
No. The case is read with fixed rules and the assessment comes from fixed rules. As a result, the same answers always give the same assessment, and no AI model looks at your case.
How certain is the assessment?
Each test shows how certain the outcome is. If the assessment depends on a missing fact, it says "depends on" with the question that decides it. Praxikon never fills anything in by itself.
Is this legal advice?
No. It is preparation that makes your own judgement, or that of your lawyer, faster and better. If you want a legal adviser to review it and sign off the case file, that is possible.
What does it cost?
The case check is free. For professionals who want to keep case files, update them when the law changes and share them with their team, Praxikon Dossier is coming.
Try it with your own case
Free, no account, and your text is not stored.
Praxikon is a trade name of Embed AI. The assessment is preparation, not legal advice. Legal references as of 8 October 2026.