Privacy and security in the assessment set

Privacy and security assessments predate AI and most organisations already run them. What changes with AI is the surface: the model itself becomes an asset to attack, training data becomes a disclosure risk, and the boundary of the system extends to whatever the model can reach.

Privacy: what is actually different

Three things. First, training data is not recoverable as a list. A model has no index of the examples that shaped a given output, which is why a deletion request is easy to honour in a database and hard to honour in a model. Decide the position before someone asks, not after.

Second, the data protection analysis has to cover the model as well as the processing. The EDPB Opinion 28/2024 of 17 December 2024 addresses personal data in AI models and is the reference point for that question in the EU. Treat it as a document to read rather than a citation to drop.

Third, the Swiss and EU regimes differ in ways that matter to a practitioner running both. The revised Swiss Federal Act on Data Protection, in force 1 September 2023, has no GDPR-style legal basis model for private controllers: under Article 30 the question is whether there is a breach of personality, justified under Article 31 by consent, an overriding private or public interest, or law. Articles 22 and 23 require a data protection impact assessment where there is a high risk to personality or fundamental rights, in particular extensive processing of sensitive data or systematic monitoring of large public areas, with consultation of the FDPIC where high residual risk remains.

Article 24 requires notification of a data security breach to the FDPIC as soon as possible. There is no seventy-two hour deadline in Swiss law. Programmes that import a GDPR playbook wholesale write one into their incident runbook anyway, and then either miss the real standard or create an internal commitment nobody asked for.

The FDPIC's stated position, first set out on 9 November 2023 and restated since, is that the FADP is technology-neutral and directly applicable to AI. There is no gap and nothing to wait for. The regulator has named real-time comprehensive facial recognition and social scoring as impermissible, and has investigated X over Grok training data.

Where the assessments connect

Article 26(9) requires deployers of high-risk systems to use the Article 13 information when carrying out a GDPR DPIA. That is a one-way dependency you should build into sequencing: instructions for use first, DPIA second. Running them in parallel produces a DPIA that describes an imagined system.

The Digital Omnibus permits a FRIA to incorporate or cross-refer to a DPIA. Use cross-reference with an explicit pointer to the section relied on, not a bare mention of the other document. An assessor who has to hunt will assume the work was not done.

Security: the AI-specific controls a conventional programme misses

A standard information security assessment will cover access control, encryption and network boundaries and will say nothing about the attacks that matter here. The AI-specific control set covers access to models, weights, prompts, training data and logs; protection against data poisoning in training data and in retrieval sources; defences against model extraction and inversion; prompt injection handling including indirect injection through retrieved content; constraints on the tools and data an agent may reach; secrets handling in prompts, logs and traces; behaviour on failure; the security posture of third-party model dependencies; and whether penetration testing was scoped to include the model surface.

That last item is the one that fails most often. A penetration test scoped to the application and excluding the model tests the part of the system that is not new. The OWASP Top 10 for LLM Applications 2026 is the working taxonomy for attack classes at the model layer, and OWASP published a separate Top 10 for Agentic Applications 2026 for systems that plan and act.

Note the regulatory overlay. The EU Cyber Resilience Act has been in force since 10 December 2024; reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026, with a twenty-four hour early warning and a seventy-two hour notification, and the main obligations apply from 11 December 2027. If your product has digital elements, that clock is separate from the AI Act's.

Worked example: an insurer assesses a document-understanding service

A health insurer wants a vendor service to extract structured fields from medical reports attached to claims. The privacy assessment and the security assessment land on the same three questions and reach different sides of them.

Health data is special category data. The processing is extensive and the data is sensitive, so Articles 22 and 23 revFADP put a DPIA squarely in scope, and the insurer runs the GDPR Article 35 assessment in parallel for its EU book. The FRIA question is separate: the service supports claims handling rather than risk assessment and pricing in life and health insurance, so Annex III 5(c) does not obviously catch it. The insurer records that reasoning rather than assuming either answer, and takes advice.

The security assessment finds the real exposure. The vendor retains submitted documents for model improvement unless retention is disabled by configuration, and the default is on. The insurer disables it contractually and technically, and adds a periodic check that the setting has not been reset by an upgrade. It also finds that the extraction service follows links embedded in submitted PDFs, which is an indirect prompt injection path straight into the model from a document a claimant controls.

Neither finding came from the model. Both would have been missed by an assessment that stopped at the model.

As of 24 September 2026.