{"slug":"eu-ai-act-art-26-9-dpia-using-provider-information","id":"AIPT-OBL-0036","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0036","title":"Deployers must use the provider's transparency information in their data protection impact assessment","short_title":"DPIA using provider information","category":"privacy_data_protection","summary":"Where a deployer of a high-risk AI system is required to carry out a data protection impact assessment under Article 35 of the GDPR or Article 27 of the Law Enforcement Directive, it must draw on the information the provider supplied under Article 13, such as the intended purpose, performance, limitations and human-oversight measures, when producing that assessment.\n","practical_action":"Attach the provider's instructions for use to the DPIA template and cross-reference the Article 27 fundamental rights impact assessment where one is required.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 26(9)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["deployer","public_authority"],"sectors":["cross_sector","employment","financial_services","public_services"],"use_cases":["hiring_and_hr","biometrics","finance_and_credit","public_services"],"applicability":[{"description":"Deployers of high-risk AI systems that process personal data in a way that triggers a DPIA.","actors":["deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Data protection impact assessment citing the provider's Article 13 information","description":null,"artifact_type":"report"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 6.1.4; Annex A.5.2","note":"AI system impact assessment process.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 3.1, MEASURE 2.10","note":"Privacy risk assessed with system information.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"privacy-and-data-protection-for-ai","title":"Privacy and data-protection controls for AI","kind":"process","relationship":"satisfies","note":"DPIA built on the provider's documentation.","confidence_level":"high","url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai"},{"slug":"ai-impact-assessment","title":"AI impact and fundamental-rights impact assessment","kind":"process","relationship":"supports","note":"Shared inputs with the fundamental rights impact assessment.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-impact-assessment"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}