Skip to content
AI Policy Generator

ESWhat applies

Registers, datasheets and records · Register · Inventory

AI Annex to the Record of Processing Activities

Additional fields for the record of processing activities when AI is involved: purpose, logic, vendors, transfers, automated decisions and retention.

GROU LLC · built on AI Business Core, by Vreinn · · How we verify sources

Who it helps

Companies using AI that keep a record of processing (for example, under the GDPR, Ecuador's LOPDP, Brazil's LGPD or Chile's Law 21.719).

Who uses it
DPO, privacy, legal and IT
Usual owner
DPO; AI governance
Formats
DOCX, PDF
Languages
Español, English
Approximate length
4 pages
Length
Standard. A complete policy, procedure, plan or guide, with roles, deadlines and evidence.
Document type
Registers, datasheets and records. Tables and forms to keep track of what exists and what was decided.
Document code
APG-INV-009. APG is the AI Policy Generator collection, INV the area (Inventory) and the number identifies the document. Use it to cite the document in your document system.

Preview

Excerpt generated from the document: the "How to use this document" section, the title and the first two sections, plus the full table of contents. The rest of the text is not shown.

APG-INV-009 · Version 1.1.0 · sources as of November 4, 2026

How to use this document

  • Use it to add to the record of processing activities the information specific to activities that involve an AI system: purpose, data, model and vendor, logic, automated decisions, transfers, retention and link to the impact assessment.
  • The DPO or privacy function usually owns it, with AI governance and IT as sources for the technical information.
  • Before adopting it, the organization should decide whether the annex lives inside its current records tool or as a separate sheet, and who updates it when a system changes.
  • Complete one entry (section 3) for each processing activity involving AI, and one row per entry in the summary view (section 6).
  • Keep the country variants where you process data and delete the rest. Some add fields or registrations with the authority.
  • Ask the DPO or your advisor to review the first entries, especially the legal basis, the description of the logic and the transfers.
  • Approve the format, share it with system owners and build it into the onboarding and change process for AI systems.

AI Annex to the Record of Processing Activities

1. Purpose and relation to the main record

1.1. This annex supplements the record of processing activities of [LEGAL ENTITY NAME] with the information specific to activities that involve an artificial intelligence system.

1.2. Each annex entry is linked to an activity in the main record by its reference. General information already in the main record is not repeated, unless AI changes it.

1.3. The annex is kept in writing, in electronic form, and made available to the data protection authority on request.

2. When an entry is created or updated

2.1. An entry is created before an AI system starts processing personal data, including pilots with real data and AI features added to existing tools.

2.2. It is updated before any of these changes takes effect: new purpose, new data or categories of people, change of model or vendor, new transfers, a move from assisted use to automated decision, or a change in retention periods.

2.3. When the system is retired, the entry is marked as retired, not deleted, with the date and what happened to the data.

Full table of contents of the document:

  • 1. Purpose and relation to the main record
  • 2. When an entry is created or updated
  • 3. AI annex entry
  • 4. Completion instructions
  • 5. Responsibilities and updates
  • 6. Summary view
  • Country variants
  • Implementation aids
  • Related regulatory references
  • Version history

Related rules

Rules in the registry whose obligations relate to this base document, based on our reading of the sources. It does not mean they apply to you.

Argentina

Brazil

Chile

Colombia

Ecuador

Spain

European Union

Mexico

Peru

Kits that include this document

Includes 7 documents

Spain / EU Kit: National, Employment and Data Layer

What Spain adds on top of the EU AI Act: human customer service (Law 10/2025), algorithmic information to staff (Workers' Statute 64.4.d and RD 723/2026), DPIA, processing record, DPO and the AEPD's oversight position, plus the high-risk AI system deployer checklist.

USD 149USD 273

Complete kit · available to buy

Includes 5 documents

Ecuador Kit: LOPDP and SPDP AI Rules

Reference DPIA to help prepare a filing with the SPDP, AI processing record, data protection officer, transfers to foreign AI vendors and 5-day breach notification.

USD 149USD 235

Complete kit · available to buy

Includes 5 documents

Chile Kit: Data Protection Law 21.719

Preparation for Law 21.719 (expected to take effect December 1, 2026, unless postponed): DPIA, processing record, transfers, breaches (Law 21.663) and notice to platform workers (Law 21.431).

USD 149USD 255

Complete kit · available to buy

Includes 91 documents

Complete pack

Every sellable template in the catalog in a single pack: base policies, procedures, registers, notices and matrices to adapt with your own team, at a flat price below the sum of the individual documents.

USD 297USD 3393

Complete kit · available to buy

What AI Policy Generator is and how it works