The vendor is selected, and Legal is asked to sign off
Imagine a U.S. company purchasing an AI recruiting tool for its French operations. The business has approved the budget, selected the vendor and scheduled the rollout. Legal receives a familiar message: “We just need the privacy assessment.”
That timing creates the real problem. Can the organization still narrow the data collection, challenge the ranking method or change suppliers? If the assessment cannot influence the project, it risks becoming a justification for a decision already made.
For U.S. legal teams, the threshold question is territorial scope. Under GDPR, Article 3, processing in the context of an EU establishment can fall within the GDPR even when it takes place elsewhere. Certain activities targeting people in the EU also fall within scope. U.S. headquarters or U.S. hosting do not, by themselves, settle the issue; nor does the presence of an EU citizen automatically make every processing activity subject to the GDPR.
When does an AI project need a DPIA?
GDPR, Article 35 requires the controller to assess processing likely to result in a high risk to individuals before it starts. The assessment concerns the processing operation, not simply the software brand or model.
The Article 29 Working Party, Guidelines WP248 rev.01 identify nine screening criteria, including scoring, significant automated decisions, systematic monitoring, sensitive or highly personal data, large-scale processing, combining datasets, vulnerable individuals, innovative uses and barriers to exercising rights or accessing a service.
Two criteria generally indicate that a DPIA is needed; one can be enough. This is not a rigid numerical test. Outside mandatory categories, a reasoned decision not to conduct one should be documented.
The CNIL, guidance on AI and data protection impact assessments also explains that AI is not automatically an innovative technology for this purpose. A proven technique and a new generative system may present different risks.
For a French deployment, the CNIL, mandatory DPIA list (French) specifically includes HR profiling, with recruitment-selection algorithms as an example. The CNIL, DPIA exemption list (French) contains limited exceptions, not a blanket exemption for small employers. Routine HR exceptions do not extend indiscriminately to profiling.
The practical starting point is a local, use-specific assessment, not a worldwide assumption that the vendor has cleared the product.
What should the assessment change?
Return to the recruiting project. Can the ranking disadvantage qualified applicants? Are irrelevant attributes being used? How long are resumes retained? Can the vendor reuse them for training? Can a recruiter meaningfully question the recommendation?
Article 35(7) requires a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of risks to people, and measures addressing those risks.
The following examples show what that can mean operationally:
| Proposed use | Risk to examine | Decision the assessment can inform |
|---|---|---|
| Ranking job applicants | An applicant is unfairly downgraded or excluded | Limit inputs, test failures and establish substantive human reconsideration |
| Transcribing internal meetings | Personal information is retained, shared or repurposed unnecessarily | Limit access and retention, and restrict secondary uses |
| Enriching customer profiles from external sources | Excessive or inaccurate information shapes targeting or scoring | Narrow sources, establish lawful use and support correction |
The output should be more than a risk score. A useful assessment identifies the control, its owner and how implementation will be checked. A proposed safeguard is not equivalent to a deployed safeguard.
Who is responsible: the customer, the vendor or the privacy officer?
The controller determines the purposes and means of the processing and is responsible for the DPIA. Under Article 35(2), it must seek advice from its data protection officer, if one is designated. A privacy officer advises; the business does not transfer its accountability by obtaining a signature.
GDPR, Article 28, particularly paragraph 3(f), requires a processor to assist with the relevant obligations, considering the nature of the processing and the information available to it. Procurement should therefore obtain usable answers about retention, access, security and secondary uses, rather than rely exclusively on a “GDPR compliant” assurance.
A vendor assessment can support the customer's work. It does not necessarily cover the customer's data, deployment settings or decision-making process. The CNIL's AI guidance expressly distinguishes development-stage assessment from assessment of the actual deployment.
For a U.S. group, central procurement and the relevant European controller therefore need to work together before implementation, not exchange documents after launch.
What happens if the remaining risk is still high?
GDPR, Article 36 requires prior consultation with the relevant supervisory authority where high residual risk cannot be sufficiently mitigated. The EDPB, Data protection impact assessment confirms this distinction: completing a DPIA does not itself authorize processing that still presents unmitigated high risk.
That does not mean every assessment must be filed with a regulator. It means the organization cannot simply accept the residual privacy risk as though it were an ordinary business exposure.
The assessment is also not frozen at launch. Article 35(11) requires review when necessary, at least when processing risks change. Turning a meeting summarizer into an employee-scoring tool is a reason to revisit the assessment, not merely update the product inventory.
Failure to carry out a required DPIA falls within the ceiling in GDPR, Article 83(4): up to €10 million or, for an undertaking, 2% of total worldwide annual turnover for the preceding financial year, whichever is higher. The maximum is not an automatic fine.
Useful protection or European paperwork?
A document does not prevent a leak or eliminate unfair ranking. Implemented controls may reduce those risks. The legal value of the DPIA is that it requires the organization to examine the purpose, necessity, consequences and safeguards before exposing people to the processing.
An existing global privacy or security review can supply evidence. It should not be assumed to satisfy the GDPR if it examines only business losses, network security or vendor assurances rather than the effects on individuals.
For general counsel, the decisive question is whether the assessment still has the power to change the project. If it can narrow the scope, change the vendor terms or stop an unacceptable feature, it is doing more than generating paperwork.
The meaningful output is not the completed template. It is the set of decisions and safeguards the assessment makes possible.
Does every AI tool require a GDPR DPIA?
No. The obligation depends on high-risk personal data processing, Article 35 and the relevant supervisory authority's lists. The presence of AI alone is not enough.
Can a U.S. company have DPIA obligations?
Yes, where its processing falls within the GDPR's territorial scope and meets the DPIA threshold. The analysis depends on the processing and the organization's role, not merely its headquarters or customers' nationality.
Can a vendor's DPIA replace the customer's assessment?
Not automatically. Vendor documentation may help, but the controller must assess its actual deployment, including the data, individuals, purposes and controls involved.
Must every DPIA be submitted to a regulator?
No. Article 36 requires prior consultation in the relevant high-residual-risk circumstances. Conducting the assessment and consulting the authority are separate requirements.
Is a DPIA a guarantee that an AI system is lawful?
No. It does not replace a lawful basis, applicable rights, security duties or other legal requirements. A late assessment also does not retroactively cure a failure to assess before processing began.