Fundamental Rights Impact Assessment
Also called: FRIA.
Where it comes from: EU AI Act, Article 27.
Applies from: December 2027.
Timing: completed before the system is put into use.
Who It Applies To
This is the first thing to establish, and it is narrower than people assume.
The obligation reaches specific categories of deployer rather than everyone deploying a high-risk system. Article 27(1) names them, and they are short enough to read here:
| Deployer category | In scope |
|---|---|
| Bodies governed by public law | Yes |
| Private entities providing public services | Yes |
| Any deployer of an Annex III point 5(b) system — creditworthiness assessment and credit scoring | Yes |
| Any deployer of an Annex III point 5(c) system — risk assessment and pricing for life and health insurance | Yes |
| Everyone else deploying a high-risk system | No |
One carve-out runs the other way: systems in the Annex III point 2 area — critical infrastructure — are excluded even for the deployers above.
Two questions, in order:
- Is the system high-risk under the Act
- Does your organization fall within one of the categories above
A high-risk system alone does not create the obligation. Both have to be true.
Establish which category you are in before you look at the point number, because the point number only decides it for the third one.
- If you are a body governed by public law or a private entity providing public services, you owe the assessment for any Annex III system except point 2 — a hiring tool included.
- If you are neither of those, only points 5(b) and (c) pull you in.
The common mistake is the second case read as though it were the only case. A private employer that is not a public-service provider, running a high-risk recruitment tool, owes the Article 26 deployer duties but no Article 27 assessment — recruitment is Annex III point 4. The same tool in a public authority, or in a private body delivering a public service, does carry the assessment.
This is a question for counsel. Get the applicability answer before building the assessment, not after.
What It Examines
The Data Protection Impact Assessment asks what happens to the data.
The Fundamental Rights Impact Assessment asks what happens to the people.
The questions it is built around:
- Which rights could be affected
- What happens to a specific person when the system gets it wrong
- Whether the system creates disadvantage for particular groups
- Who is accountable for the outcomes
- What oversight exists
- Whether affected people can meaningfully challenge a decision
That last one is the heart of it, and it is the question a data protection assessment does not ask.
What It Has to Cover
The deployer's own use, described concretely:
- The processes in which the system will be used
- How long you intend to use it and how often
- The categories of people likely to be affected
- The specific risks of harm to those categories
- The human oversight arrangements in place
- What happens if a risk materialises — governance, escalation, complaint routes
Note the emphasis on your deployment. This is not an assessment of the technology in general. It is an assessment of what you are doing with it, to whom, in your context.
After It Is Done
Two duties follow the assessment itself, and both are easy to miss.
Notify the regulator. Once the assessment is performed, the deployer notifies the market surveillance authority of its results, submitting the completed template as part of the notification (Article 27(3)) — once the AI Office template exists. Deployers may be exempt where a market surveillance authority has authorised the system under Article 46(1).
Keep it current. The obligation attaches to first use. If, during use, you consider that any of the elements above has changed or is no longer up to date, you update it (Article 27(2)). For similar cases you may rely on an earlier assessment, or on one the provider carried out — but the update duty stays yours.
A Note on the Template
The official template contemplated by Article 27(5) had not been published as at the version date on this handout. Article 27(5) was itself replaced by the 2026 amendments: the AI Office must still develop the template, and the new text directs that it give deployers the possibility, where relevant, to cross-reference a data protection impact assessment or include relevant parts of it.
Organizations are building the assessment from the Article's own requirements. Where structured guidance exists, it comes from civil society and human rights bodies rather than the regulator.
Practical consequence: document your reasoning about structure as well as substance. If the format is later standardized, you want a record of why you built it the way you did.
Where the Information Probably Lives
| What you need | Where to look |
|---|---|
| High-risk classification | Prior governance record; vendor documentation; counsel |
| Whether you fall in the deployer categories | Counsel |
| The processes the system supports | Business lead; process documentation |
| Intended duration and frequency of use | Business lead; the business case |
| Categories of people affected | Business lead; HR; the customer record system |
| Whether vulnerable groups are included | Business lead; the population served |
| Specific risks of harm | Business lead; prior incidents; complaint records |
| Human oversight arrangements | Business lead; process documentation; IT configuration |
| Who can override the system | Business lead; the named owner |
| Escalation route | Incident response documentation; security |
| Complaint mechanism | Customer service; HR for employee-facing systems |
| Provider information about the system | Vendor documentation; the instructions for use |
| Existing data protection assessment | Privacy team — reuse what overlaps |
On the last row. Where a Data Protection Impact Assessment already exists for the same deployment, the factual sections overlap substantially. Reuse the description of the processing rather than rewriting it.
The analysis does not overlap. The facts do.
Who Supplies What
Counsel:
- Whether the obligation applies at all
- Whether the assessment is sufficient
You or the privacy function:
- Structure and assembly
- Coordinating the input
- The record
The business:
- What the system does in practice
- Who is affected
- What happens when it is wrong
People closer to those affected:
- Employee representatives, where the system touches workers
- Customer-facing teams, where it touches customers
- Anyone who handles complaints about the current process
That last group is easy to overlook and worth including. The people who field complaints already know how the existing process fails people.
Common Gaps
- Built before applicability was confirmed. Establish whether you are in scope first.
- Assessed the technology rather than the deployment. The Article asks about your use, in your context.
- Affected groups described too broadly. "Customers" is not a category of person likely to be affected. Which customers, in what circumstances?
- Human oversight described as existing rather than functioning. Who can override it, do they have the information to do so, and does it happen in practice?
- No complaint route. If someone is affected and disagrees, what do they do?
- Nobody outside the project consulted. The assessment is about people. Talk to someone who represents them.
- Treated as a document exercise. If the assessment surfaces a serious risk and nothing changes, it has not done its job.
One Practical Note
This assessment is not a compliance artifact bolted onto a decision already made.
It is intended to inform whether and how to deploy. An assessment produced after the deployment decision, to justify it, satisfies the form and misses the point — and that is visible to anyone reading it.
Applicability and content requirements should be confirmed against the current text of the Act, and applicability specifically should be confirmed with counsel before relying on this handout.
Sources
- EU Artificial Intelligence Act, Regulation (EU) 2024/1689 — Article 27, with Annex III for the high-risk categories and Article 26 for the wider deployer obligations
- The applicability categories are set out in Article 27(1). Read them directly.
- The template contemplated by Article 27(5) had not been published at the time of writing
- Article 27(2) for first use, reliance on earlier assessments, and the update duty; Article 27(3) for notifying the market surveillance authority; Article 27(4), as amended by Regulation (EU) 2026/1744, which lets the assessment cross-reference or include relevant parts of an existing Data Protection Impact Assessment
- The December 2, 2027 application date also comes from Regulation (EU) 2026/1744, which amended Article 113. Read the Act as amended.
Structured methodologies have been published by civil society and human rights organizations rather than by the regulator. Where you rely on one, record which and why.
Applicability specifically should be confirmed with counsel. A high-risk classification alone does not create the obligation.
Use and reuse
Free to use, share, and adapt within your organization. Attribution appreciated, not required. No warranty of any kind — this is practitioner guidance, not legal advice, and sufficiency is determined by your counsel.
LegisGate · Regulatory Intelligence for AI Deployments · legisgate.com
Written by compliance and audit practitioners who spent decades on the other side of the table.
Version 1.1 · Current as of September 2026 · Verify time-sensitive claims against current sources before relying on them.