DPIA, IAMA and fundamental rights assessment: one review for a municipal AI application
Short answer
A local authority deploying AI faces three assessments. The DPIA is mandatory under the GDPR where there is a high risk to individuals, which is almost always the case with AI and personal data. The IAMA is the Dutch instrument for human rights and algorithms. The fundamental rights impact assessment in Article 27 of the AI Act becomes mandatory from December 2027 for public bodies deploying high-risk AI. Do them as one exercise: the same facts, three angles.
Three assessments, one application
| Assessment | Basis | When mandatory | Core question |
|---|---|---|---|
| DPIA | GDPR Article 35 | Where a high risk to individuals is likely; the Dutch authority publishes a list of mandatory cases | Which personal data, which risk, which measures? |
| IAMA | Dutch instrument, revised in February 2026 and aligned with Article 27 | Not statutory, but the standard in government and in the national algorithm framework | Which human rights does the algorithm touch, and is that justified? |
| Fundamental rights assessment | AI Act Article 27 | For public bodies deploying Annex III high-risk AI, from 2 December 2027 | Which rights, which groups, which oversight, which measures? |
Article 27 itself says the fundamental rights assessment may complement the DPIA where they overlap. The IAMA was revised precisely for that. See The EU AI Act in 2026 for the deadlines.
As one exercise
- Describe the application first. Purpose, users, input, output, which decision it influences, which groups it affects. This part is the same for all three.
- Classify. Is it an AI system under the AI Act, and if so, in which risk class? An assistant for reports is not high-risk; a system that co-decides on benefits or permits is.
- Personal data. The DPIA questions: legal basis, necessity, minimisation, retention, processors, transfers. With a public AI service this usually founders on transfer and purpose limitation.
- Fundamental rights. Equal treatment, privacy, good administration, access to services. Which groups are affected differently, and how do you test that? See Testing algorithms for discrimination.
- Measures and oversight. Human control, logging, complaints route, review date. Record who is responsible.
- Publish. Register the application in the algorithm register with a reference to the assessment. See Filling the algorithm register.
Common mistakes
- The assessment after purchase. Then every risk has become the supplier’s problem. Do the assessment during procurement.
- Once and done. A new model or a new source is a new assessment. Plan an annual review.
- Assessing the model instead of the application. The same model is low-risk for minutes and high-risk for a decision on welfare.
- Nobody affected was heard. The IAMA asks for the perspective of those affected. A client council or ombudsman often supplies the sharpest questions.
How werqly fits in
An environment of your own makes the DPIA shorter: no transfer, no supplier training models on your data, access per role and an audit log that makes the measures demonstrable. For the fundamental rights assessment werqly AI Control supplies the facts: which models, which sources, which roles, which use. See AI for local government.
Frequently asked questions
Questions on this topic
Is a DPIA mandatory for every AI application?
Where a high risk to individuals is likely, yes, and with personal data in AI that is almost always the case. The Dutch data protection authority publishes a list of processing operations for which a DPIA is always required.
What is the difference between the IAMA and the AI Act assessment?
The IAMA is a Dutch instrument that looks more broadly and is not statutory. The fundamental rights impact assessment in Article 27 is a legal duty for public bodies deploying high-risk AI. The IAMA was revised in 2026 so that it satisfies Article 27.
From when does Article 27 apply?
For Annex III high-risk AI from 2 December 2027, after the shift by the Digital Omnibus. The assessment must be complete before first use.
Does a text assistant for minutes also need a full IAMA?
A DPIA yes, if the minutes contain personal data. A full IAMA is meant for algorithms that influence decisions; for an assistant a short check and an entry in the register usually suffice.
Sources
- Government of the Netherlands — Impact Assessment Human Rights and Algorithms (February 2026, Dutch)
- Artificialintelligenceact.eu — Article 27: Fundamental rights impact assessment
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.