From free report to paperwork: three new AI Act and GDPR documents

If you have already run Komplya's free applicability questionnaire, you have a plain-language answer to the question "does the EU AI Act or GDPR apply to what we're doing." That questionnaire is still free, and it is not going anywhere. What has changed is what happens next. Knowing your obligations and being able to hand someone else proof of them are two different problems, and until now the gap between them meant copying an on-screen result into your own document, by hand, hoping it held up. We just closed that gap: three new one-time purchases turn the free report into documents built to be handed to a bank, a client, an investor, or an auditor.

What's new

AI-Act Risk Classification Report — €49

This is your free applicability report, reformatted into a branded, citation-backed export. Same underlying engine output, same analysis, but structured and referenced as a standalone document rather than a page on screen. It exists for the moment someone outside your company asks you to prove a classification rather than just state it: a bank underwriting a loan, an investor's due-diligence checklist, a client's procurement questionnaire, or your own internal audit file. Instead of screenshotting a webpage, you attach a document with the legal citations built in.

DPIA generator — €69

A Data Protection Impact Assessment, drafted by an LLM and structured to follow GDPR Article 35(7): a systematic description of the processing, a necessity and proportionality assessment, an assessment of risks to the rights and freedoms of individuals, and the mitigating measures you have in place or plan to put in place. The drafting is grounded in the Article 35(3) and WP248 trigger criteria, so the document reasons about your actual processing rather than filling in a generic template. Who asks for this: data protection authorities, works councils, larger customers running vendor security reviews, and your own DPO if you have one.

Full bundle — €99

Both policy documents (AI Usage Policy and Privacy Policy), the risk classification report, the DPIA, and a new Evidence & Audit Pack cover sheet that indexes everything into one package. The cover sheet exists so that whoever receives the bundle, an auditor, an investor, a regulator, does not have to work out which document answers which question; it is already indexed for them.

When do you actually need a DPIA?

This is worth understanding on its own terms, independent of whether you buy anything. GDPR Article 35 requires a DPIA when a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of individuals. Article 35(3) and the Article 29 Working Party's WP248 guidelines set out the criteria regulators actually use to decide whether that threshold is met. If your processing meets two or more of the following, a DPIA is very likely required; several AI systems trip more than one on their own:

• Evaluation or scoring, including profiling that produces a legal or similarly significant effect on a person, such as automated credit scoring or CV screening that filters candidates.
• Large-scale processing of special category data (health, biometric, ethnicity, political opinion, and similar) or data relating to criminal convictions.
• Systematic monitoring of individuals, including monitoring in a publicly accessible area or ongoing observation of behaviour.
• Processing that involves vulnerable data subjects, such as employees, children, or people in a position of economic or social dependency relative to the controller.
• Innovative use of technology or organisational solutions, including novel applications of AI, where the risks to individuals are not yet well understood or established practice.
• Data matching or combining datasets from different sources beyond what a person would reasonably expect.

In practice, most companies running an AI system that screens people, scores them, or monitors their behaviour will meet at least two of these on the first pass. That is exactly the population the free questionnaire is built to flag, and it is why a DPIA is one of the first pieces of paperwork that follows a "this applies to you" result rather than a nice-to-have for later.

The math holds regardless of which document you need most urgently this week. If you only need the risk report for a bank submission, buy that alone for €49. If a DPIA is the immediate ask from a client or a DPA, that's €69 on its own. But if you know you will eventually need more than one of these, and most companies handling AI Act and GDPR obligations do, the bundle is the cheaper path to the same paperwork rather than a premium add-on.

None of this replaces the free applicability questionnaire, and it is not legal advice for your specific situation. The questionnaire still answers whether something applies to you, and remains free. These three purchases answer a different question: once you know what applies, what do you actually hand to the person asking for proof.