The III DPD Online Meeting allowed the AOC to present the progress of the report transparència algorithmic (TRAL) and contrast its approach with data protection professionals. The Ethical and Responsible AI Working Group has been working for a year on the evolution of this report towards a reference model that combines understandable information for citizens with verifiable accountability on the risks, guarantees and governance of artificial intelligence (AI) systems.
The meeting, organized by the APDCAT on October 29 at the Biomedical Research Park in Barcelona, brought together data protection delegates (DPD) to address, among others, the challenges of digital regulation and artificial intelligence. Carme Callés, Head of Innovation Service, and Patricia Mallén, DPD of the AOC, led a practical workshop and a presentation of the results of the Working Group, united by the same question: How can we make the risks, safeguards and governance of AI systems used by any entity visible, understandable and verifiable?
From risk to guarantee: putting risk management into practice
In the morning we conducted the participatory workshop "From risk to guarantee", in which fifteen participants, distributed in three teams, worked on a practical case study: a city council that uses generative AI to prepare the anonymization of plenary sessions before publishing them on the portal. transparènciaThe challenge was to make the transparència and the right of access to public information with the protection of personal data.
Based on this scenario, we worked on two very direct questions:
- What could go wrong? (risks)
- What can we do to prevent or reduce these risks? (measures and guarantees)
Prioritization generated int matcheseressaints. Two of the three teams placed among the main risks the fact that the AI does not detect personal data that should be anonymizedAll three also prioritized the risk of reversal of anonymization applied once the minutes were published. Other prominent concerns were the reviewer's overconfidence in the AI results, the unauthorized reuse of documents by the model provider, and the accidental publication of an unvalidated version.
The proposed answers clearly show that a risk may require several measures and the same measure may contribute to controlling different risks: effective human review, blocking of publication without validation, clear criteria on what needs to be anonymized, user training, irreversible anonymization, testing with different formats, access controls or contractual guarantees regarding the reuse of documents. This was precisely one of the principles of the proposed dynamics.
The debate was so rich that we did not manage to complete the third activity, dedicated to explain this risk management to the public (transparència). However, being able to dedicate more time to risks and guarantees allowed us to compare criteria and delve deeper into them, which was also one of the objectives of the workshop.
A year building a shared reference model
In the afternoon we presented "From the AI Regulation to the TRAL report: from obligations to one transparència that is understood", to share the work developed over the last year by the working group.
The group was established on October 30, 2025 with the aim of evolving thereport transparència AOC algorithm, the TRAL, and move towards a reference model applicable to different use cases and risk levels.
The new model is structured in two layers:
- A layer of transparència for the citizens, which explains the service in clear language: what it does, why it uses AI, how it works, what can go wrong, what we do to avoid it and who is responsible.
- A layer of governance and accountability, which documents in more detail the data, operation, legal qualification and regulatory guarantees, human supervision, risk management, monitoring and available evidence.
This makes it visible and verifiable not only that an entity uses AI, but also how it is governing that system and how it manages the risks it generates.
And there is an important distinction: The TRAL does not replace any data protection impact assessment (DPIA), a fundamental rights impact assessment (FRIA), legal analyses, technical documentation, or other applicable assessments and obligations.On the contrary: it complements them by taking advantage of the information and evidence generated by these instruments, structuring them from the perspective of transparència and helps to explain the guarantees adopted in an understandable way.
Precisely, one of theeres The group's goals will be to complete the new TRAL model for high-risk AI systems, adapting its risk management methodology and studying how to adequately incorporate a synthesis of the FRIA results aimed at transparència.
From the workshop to the TRAL
The afternoon presentation allowed us to close the circle with the morning's work.
When participants identified what could go wrong, they were working on the same logic as section 1.6 of the TRAL. And when they discussed what we could do to prevent or reduce risks, they were building the foundation for section 1.7. These sections of the citizen layer are synthesized from the more detailed analysis of risks, measures, and evidence documented in the governance and accountability layer.
The participants did not produce the entire TRAL report, but part of its core: identify what worries us, decide what we do to control it and prepare ourselves to be able to explain it.
Transparència to be accountable
The III DPD Online Meeting has allowed us to contrast the model with data protection professionals and continue a construction that we want to be collective, multidisciplinary and adaptable to the reality of public administrations.
The challenge now is to continue transforming this methodology into a tool useful, understandable, verifiable and reusable, which helps us turn AI governance into a transparència effective and meaningful for citizens.
