; and (ii) new high-risk automated decision systems, prior to implementation; provided that a covered entity may evaluate similar high-risk automated decision systems that present similar risks in a single assessment; (B) require each covered entity to conduct data protection impact assessments of— (i) existing high-risk information systems, as frequently as the Commission determines is necessary; and (ii) new high-risk information systems, prior to implementation; provided that a covered entity may evaluate similar high-risk information systems that present similar risks in a single assessment; (C) require each covered entity to conduct the impact assessments under subparagraphs (A) and (B), if reasonably possible, in consultation with external third parties, including independent auditors and independent technology experts