Impact assessments that stay linked to their controls.

How to use it

1. Choose the instrument. The three share one record (the impact-assessment schema): identification, risks, measures, outcome, approvals and triggers are common; the elements differ.
2. Fill the elements. Then list the specific risks, each with an id, and the measures. Tick the risks each measure addresses and pick the pattern that implements it.
3. Choose "Check the record": problems are listed at the top, each linked to its field. The result shows which elements are filled and which risks still have no measure.
4. Export JSON or YAML to keep the record in the repository next to the system, where a change to the system shows up as a change to the assessment; export Markdown for readers.

Your draft stays in this browser (local storage), not in the link, because an assessment holds internal detail. The instrument you picked is kept in the link.

By hand, without JavaScript

Use the impact assessment template, which names every field of the record, with the element lists below.

FRIA: the Art. 27(1) elements

A deployer that must run a FRIA does so before first use and updates it when an element changes (Art. 27(2)), then notifies the market surveillance authority of the results (Art. 27(3)) [1]. Since the Digital Omnibus it may cross-reference or include the relevant DPIA sections, and the duty applies with the Annex III regime from 2 Dec 2027 [2]. For the method behind the elements (scoping, likelihood and severity matrices, worked cases), the Catalan Data Protection Authority publishes a FRIA model with four use cases [9]; its answers fit the same fields.

AIIA: the ISO/IEC 42005 elements

ISO/IEC 42005:2025 gives guidance for assessing an AI system's impacts on individuals, groups and society [4]. The builder keys each documented element by its clause id, with the ids and headings the INCITS/AI crosswalk lists against the draft (DIS) [5]: verify them against the published text. The impacts themselves (6.8) go in the risks and the measures.

DPIA addendum: Art. 35(7) and the AI-specific fields

A DPIA contains at least the four points of Art. 35(7), is carried out with the advice of the data protection officer (Art. 35(2)) and is reviewed at least when the risk of the processing changes (Art. 35(11)); a high residual risk means prior consultation of the authority (Art. 36) [3]. The addendum adds what a generic template lacks for AI: training versus operational data, solely automated decisions, inferences about people and memorisation [7]. The EDPB put a common DPIA template to public consultation in 2026; it is a draft, so check its status before you adopt its structure [10].

• (a) A systematic description of the processing and its purposes: processing_description
• (b) An assessment of necessity and proportionality: necessity_and_proportionality
• (c) An assessment of the risks to the rights and freedoms of data subjects: risks
• (d) The measures envisaged to address the risks: mitigations

Every risk linked to a measure, every measure to a pattern

A risk without a measure is an open finding; a measure without a risk is a control nobody can justify. The builder gives each risk an id (R1, R2 ...), lets each measure tick the risks it addresses, and names the pattern that implements it and the controls or obligation ids it evidences. The result lists any risk still without a measure. The patterns you can pick:

• Policy Card
• Eval Gate in CI
• Adversarial Red-Team Suite
• Agent Registry
• AIBOM
• Model Card as Control Evidence
• Continuous Assurance Telemetry
• Runtime Guardrail
• Kill Switch / Circuit Breaker
• Incident Pipeline
• FRIA-as-Code
• Framework Crosswalk
• Machine-Readable Evidence (OSCAL)
• Agent Identity & Scoped Credentials
• Human-in-the-loop Gate
• Shadow-AI Discovery
• Vendor / Model Due-Diligence Gate
• Use-Case Intake & Risk Tiering
• AI Threat Model
• Training-Data Rights Ledger
• Dataset Admission Gate
• Fairness Eval Suite
• Explanation Artefact
• Model Artefact Integrity
• Claims Substantiation Gate
• Decision Notice & Contest Path
• Rights Requests Against Models
• Sanctioned AI Gateway
• Staged Rollout with Rollback Criteria
• Drift & Fairness Monitor
• Downstream Use Register
• Disclosure & Notification Pipeline
• Deactivation, Localisation & Retirement Runbook

Re-open triggers

An assessment is only as current as the last change it saw. The record lists what reopens it [6]; the FRIA-as-Code pattern wires those triggers to the pipeline [8]. The preset triggers, with the instruments they apply to:

• An Art. 27(1) element changed or is no longer up to date (Art. 27(2)) (Fundamental rights impact assessment)
• The risk represented by the processing changed (GDPR Art. 35(11)) (AI addendum to a DPIA)
• New or changed intended purpose (Fundamental rights impact assessment, AI system impact assessment, AI addendum to a DPIA)
• New data source or training data (Fundamental rights impact assessment, AI system impact assessment, AI addendum to a DPIA)
• New group of people affected, or a new country (Fundamental rights impact assessment, AI system impact assessment, AI addendum to a DPIA)
• Model or system change beyond the pre-determined changes (Fundamental rights impact assessment, AI system impact assessment, AI addendum to a DPIA)
• Serious incident, or a complaint alleging harm (Fundamental rights impact assessment, AI system impact assessment, AI addendum to a DPIA)
• A monitoring metric crosses its threshold (Fundamental rights impact assessment, AI system impact assessment, AI addendum to a DPIA)
• The provider updated the instructions for use (Fundamental rights impact assessment, AI system impact assessment)
• The scheduled review date is reached (Fundamental rights impact assessment, AI system impact assessment, AI addendum to a DPIA)

What this is not

It does not decide whether a FRIA, a DPIA or an AIIA is required for your system, and it does not replace the authority's template for the Art. 27(3) notification. It checks the shape of the record, not the quality of the assessment. The element lists are as of 2026-09-24. Illustrative, not a claim of conformity.