Overview and Implementation Guide

#About this document set

This is the entry point to Relyance's Assessments documentation. Start here, then branch out to the guide that matches your role:

#What is Relyance Assessments?

Relyance Assessments is the structured-questionnaire engine built into the Relyance AI platform. It's the same underlying system whether you're running a Data Protection Impact Assessment (DPIA), a vendor/third-party risk or application security review, an assessment against an AI model or a cataloged AI use case for governance purposes, or a fully custom compliance questionnaire:

1. Build a template out of sections and questions - free text, single/multi-select, matrix, and questions mapped to drive entity-trigger logic - with rich-text descriptions to guide whoever answers.
2. Create an assessment from that template - by hand, directly from a ROPA/processing-activity record, against an AI model or AI use case, or programmatically through the Assessment Workflow API.
3. Populate and answer - assessment owners and invited stakeholders work through the questions. The Assessment Population API can pre-fill answers from what Relyance already knows about the entity the assessment concerns, and an AI Assistant can answer many question types directly, with its answers flagged and its reasoning available to review.
4. Share and collaborate - invite stakeholders, restrict access to specific emails, and comment on individual questions.
5. Complete - mark the assessment complete. Where Attestations are enabled, completed answers push back to update the vendor, product, or record the assessment was run against, with a before/after preview before anything is written, and the assessment moves to Needs Review (rather than silently going stale) if that record changes afterward.
6. Audit and report - every change is logged at the field level, the assessment itself can be exported as a PDF or a ZIP file, and Relyance can alert you if the underlying data map drifts after the assessment was marked complete.

Because template design, creation, answering, sharing, and logging are all part of one connected system rather than a standalone form builder, a question added to a template today is immediately available the next time that template is used, and every answer change - whoever makes it - lands in the same audit trail.

In practice, this shows up differently depending on who's running the review:

• A security team uses it for AppSec and vendor security reviews - triggering a scoped assessment as part of vendor intake, before a contract is signed, with the result feeding back into the vendor record.
• An AI governance team uses it to assess an AI model or a cataloged AI use case against a standard risk template before the system goes live, and to export a compliance package once the review is done.
• A privacy team uses it for DPIAs and ROPA-linked assessments, with the GDPR Article 35 and ISO 27701 drivers described in the Legal and Compliance Guide.

#How the pieces fit together

Assessment Templates  →  Create Assessment      →  Populate & Answer    →  Share & Collaborate  →  Complete             →  Audit Log & Reporting
(sections, question      (manually, from a ROPA     (owners and             (invite stakeholders,    (mark done; push        (every change logged,
 types, entity-trigger    record, for an AI model    stakeholder                restrict by email,       completed answers       exportable, drift
 mapping)                 or use case, or via the    complete questions;        comment per question)    back to the source       alerts on completion)
                          Workflow API)               Population API pre-                                record)
                                                       fills answers)

• Assessment Templates are where an admin designs the sections and questions a given assessment type will ask - see the Admin Configuration Guide.
• Creating an assessment instantiates a template against something specific - a vendor, a processing activity, an AI model, an AI use case, or a standalone questionnaire. See the Admin Configuration Guide for every entry point, and the Technical Implementation Guide if you're triggering creation from your own systems.
• Populating and answering is where the actual work happens - manually, or pre-filled by the Assessment Population API where it's enabled for your account. See the API Reference.
• Sharing and collaboration covers stakeholder invitations, restricted (email-matched) access, and comments - see the Admin Configuration Guide.
• Completing an assessment can be gated by prerequisites (for example, an uploaded Data Processing Agreement on certain assessment types) and, once complete, is where drift notifications and the push-back to source records come in - see the Admin Configuration Guide.
• The Audit Log captures every change for compliance and reporting - see Assessment Audit Log and Reporting.

#Implementation roadmap

A typical rollout moves through five phases. Admins (privacy, security, or compliance - whoever owns your assessment program), the teams who'll actually answer assessments, and engineering (if you're integrating via API) are involved at different points.

#Phase 1 - Build your template library

Owner: Admin. Design the sections and questions for each assessment type you need (DPIA, vendor risk, AI model/use case, or a custom questionnaire). Decide which questions need matrix layout, which need entity-trigger mapping, and where richer descriptions or HTML-formatted guidance will help respondents. See the Admin Configuration Guide.

#Phase 2 - Decide how assessments get created

Owner: Admin, with engineering if using the API. Most assessments start from a specific entry point rather than a blank template: from a ROPA/processing-activity record, against an AI model or a cataloged AI use case, or triggered programmatically - for example, a workflow that creates a vendor record, creates an assessment against it, and shares it with stakeholders in one call. See the Admin Configuration Guide and the Technical Implementation Guide.

#Phase 3 - Configure sharing

Owner: Admin. Decide who can create, view, and complete assessments, and how external stakeholders will be invited - including whether access to a given assessment should be restricted to specific email addresses. See the Admin Configuration Guide.

#Phase 4 - Run assessments

Owner: Assessment owners and stakeholders. Work through templates, answer questions, resolve comments, and mark assessments complete. If your account has the Assessment Population API enabled, review pre-filled answers rather than starting from a blank form.

#Phase 5 - Monitor, audit, and report

Owner: Admin, ongoing. Review the Assessment Audit Log for a given assessment when you need to show an auditor what changed and when, watch for drift notifications on completed assessments whose underlying data has since changed, and export logs as needed. The Assessments dashboard gives you a higher-level view across all of this - SLA settings and status history at a glance, with every figure clickable through to the records behind it. See Assessment Audit Log and Reporting.

#Who should read what

• New to the product / evaluating it? Start with this doc, then the FAQ.
• Legal, privacy, security, or compliance? Read the Legal and Compliance Guide.
• Integrating via API or configuring entity-trigger mappings? Go straight to the Technical Implementation Guide.
• Building templates and running the module day-to-day? The Admin Configuration Guide is your reference.
• Pulling reports or preparing for an audit? Assessment Audit Log and Reporting.