Do I need a FRIA?

01

Who Article 27(1) reaches

Article 27(1) makes a FRIA mandatory for deployers of Annex III high-risk AI systems who are: bodies governed by public law; private entities providing public services; or deployers of Annex III point 5(b) (creditworthiness evaluation) or point 5(c) (life and health insurance risk assessment and pricing).

Annex III point 2 (critical infrastructure safety components) is carved out of the Article 27(1) FRIA duty — even for public bodies.

Employment and recruitment AI sits in Annex III point 4. That category is outside the Article 27(1) mandatory trigger list. Article 27(4) encourages FRIAs more broadly; encouragement is not the same as the mandatory list.

02

When the duty becomes enforceable

High-risk Annex III deployer obligations — including the Article 27 Fundamental Rights Impact Assessment where Article 27(1) applies — become enforceable on 2 December 2027 (extended from 2 August 2026 under the EU Digital Omnibus). That date is read from LegisGate Meridian / the regulatory canon (EU Digital Omnibus alignment). A Dynamic FRIA prepared before that date is counsel preparation ahead of enforceability — not a claim that the duty is already live.

03

Why question design matters

Without asking whether the organisation is a public-law body or a private public-service provider, and without asking whether the AI is embedded in a regulated product, a short check will overcall FRIAs for hospitals and private employers. Those are dead leads.

Private entities that may provide a public service should sit in “may apply — depends on whether you qualify,” not in the headline “likely required” list.