The determination finds the states
From the jurisdictions you declare, it establishes which states the AI use case reaches and which of their statutes call for an assessment, with the provision that says so.
LegisGate · data protection assessment · US states
The assessment your state statute happens to call something else.
Virginia-model statutes call this document a “data protection assessment.” California's regulations call the same kind of document a “risk assessment.” Different statutes, different word — one kind of assessment, done in LegisGate the same way, once for each state, under the name that state uses.
Basis
State privacy / data protection statutes
Scope
The states the AI use case reaches
Included
With the AI use case that calls for it
How a data protection assessment is done in LegisGate
Four steps, and you never have to work out what the document is called.
It is the state assessment, opened from the determination, under the title that state’s statute gives it.
A draft opens for each state, named as the statute names it
Where a state’s law says “data protection assessment,” that is the title of the draft. You do not get a second document for the same state under a second name.
Our half is written from that state’s statute
The processing described in that statute’s vocabulary, the safeguards the provision expects, the heightened-risk analysis with the categories that statute recognises, and how long to keep the assessment, from the provision that says so.
You complete the sections that are yours
LegisGate prepares the regulatory half of each state assessment automatically and marks the sections your organisation completes; guided questions are added state by state (California first). The assessment register and Mark reviewed work as they do for every written assessment, and the export carries a status line on its cover saying how many questions are accepted and whether it has been reviewed.
Monitoring is included and automatic: when the law behind a question changes, that question is flagged, and the activity log records who answered, accepted, assigned and exported.
Your first five AI use cases are free, with everything included: the laws, the obligations, the written assessments and monitoring. No card. More than five is a subscription.
The naming, not the duty, is what varies
One assessment, named as each statute names it.
Nothing in the corpus gives a state two separate assessment duties under two separate names. What changes state to state is the statute's own word for the document, not the document itself.
01
The title follows the statute
The assessment is titled with the term your state's law actually uses, sourced to that statute, never a generic label standing in for it.
02
One for each state
One state, one assessment, included with the AI use case that calls for it. See the state privacy risk assessment page for how the duty differs from state to state, and for the California assessment in the workspace.
We bring the regulatory intelligence and the intake. You bring the privacy and legal judgment for your use case and organization. The document is built to hold both.
The division of labour, stated onceWhat this is not. LegisGate produces regulatory intelligence and assessment-preparation materials. Nothing we produce is legal advice, a legal opinion, a certification, or a determination of compliance, and no document we deliver satisfies a legal obligation on its own. Sufficiency is determined by your counsel.
One determination, one assessment for each state
Whatever your state's statute calls it.
Add the AI use case, and the determination establishes which states it reaches. The assessment each of those statutes calls for is opened from the same answers. Your first five AI use cases are free.