Sector deployments of high-risk systems need oversight that can be exercised in practice, evidence that traces a decision from system output to human action, and, where Article 27 requires it, a fundamental-rights impact assessment. Article 27 requires deployers that are bodies governed by public law, and private deployers providing public services in specified Annex III areas, to carry out a fundamental-rights impact assessment before first use of a high-risk system, covering the deployment context, the affected people, the fundamental rights that may be affected, the risks, the oversight and the measures to address the risks. The assessment must be notified to the market surveillance authority and, where applicable, published. This guide is an outline only: the deployers and uses covered, and the assessment's contents, must be checked in the consolidated text of Article 27 for the specific case.
Who must carry out a fundamental-rights impact assessment?
Article 27 applies, in outline, to deployers of high-risk AI systems that are bodies governed by public law, and to deployers that are private entities providing public services, where the system is listed in Annex III points 5(b) and 5(c) on creditworthiness and insurance pricing, and to deployers of systems intended to evaluate creditworthiness or establish credit scores and systems for risk assessment and pricing in life and health insurance. It also applies to deployers that are financial institutions carrying out a fundamental-rights impact assessment under other law in defined circumstances. The scope is therefore defined by deployer type and by Annex III area together, and a deployer should check both elements before concluding that an assessment is or is not required. A public body deploying an Annex III system in education, employment or essential services should not assume the assessment is unnecessary, and a private deployer should not assume it is always required. The consolidated text of Article 27, the deployer's legal status and the system's Annex III point must be examined together, with qualified advice where the scope is unclear.
What should a fundamental-rights impact assessment cover?
A fundamental-rights impact assessment should describe the deployer's processes, the intended purpose, the deployment context and the period and frequency of use, the categories of natural persons and groups likely to be affected, the specific risks of harm to fundamental rights, the human oversight measures, the measures to address the risks, and the governance arrangements for the deployment. It should also address the complaints and redress mechanisms available to affected people and the plan for monitoring and review. The assessment should be based on the actual deployment, not on a generic template: the affected groups, the risks and the mitigations must reflect the population, the setting and the decisions concerned. The assessment should be prepared before first use, with input from the people and teams who understand the deployment context, and should be updated where the deployment, the population or the system changes. A template completed without deployment-specific analysis does not satisfy the provision, however complete it looks.
For the broader regulatory framework, see healthcare and biometrics under the AI Act.
How is an assessment notified and published?
The deployer must notify the market surveillance authority of the results of the fundamental-rights impact assessment, and must publish a summary of the findings, subject to the exceptions in the provision, including where the summary would conflict with other legal obligations. The notification and publication duties make the assessment a public accountability document, not only an internal risk exercise, and the deployer should write it accordingly: precise about the deployment and the risks, honest about the limitations and the open questions, and clear about the measures taken. The full assessment should be kept with the deployment file, with the notification date, the authority notified and the publication location recorded. Where the assessment identifies a risk that cannot be mitigated, the deployer should not proceed on the basis that the assessment itself is the mitigation: the deployment should be changed, restricted or not carried out, and that decision should be recorded with the assessment.
How should oversight be organised in a sector deployment?
Oversight should be organised around the decisions the system influences, with a named overseer for each decision type, the competence and training the overseer needs, the information the overseer receives, the time available for review, and the authority to decide differently from the system. The overseer should understand the system's purpose, limitations and error patterns, and should be able to access the input data, the output and the reasoning the system provides, as well as information beyond the system that bears on the decision. Oversight should be recorded: the decision, the output, the information considered, the overseer's decision and any override should be logged, so a later review can see that oversight was exercised. The deployer should monitor whether oversight is real in practice, including whether overseers have time, whether they override, and whether they raise concerns, and should act where oversight is being bypassed or rubber-stamped. An oversight design that looks complete on paper but is not exercised is a compliance gap, not a control.
What evidence should a sector deployment keep?
A sector deployment should keep the classification and prohibition records, the provider information, the fundamental-rights impact assessment where required, the data protection assessment, the oversight design and logs, the information given to affected people, the monitoring of outcomes, the complaints and appeals, and the review and change records, all linked by the system version identifier. The evidence should allow a reviewer to trace a single consequential decision from the system's output, through the human review, to the decision and its communication, and to see what happened when the decision was challenged. The file should be reviewed at defined intervals and when the system, the population or the deployment changes, and the review should be recorded. A deployment file that is assembled only when an authority asks for it will be incomplete, and the gaps will be visible. The file should be maintained as the deployment proceeds, by the people who operate the system, not reconstructed afterwards.
Continue with how sector law sits alongside the AI Act.
What does this guide not decide?
This guide does not decide whether any deployer must carry out a fundamental-rights impact assessment, what any assessment must contain for a specific deployment, or whether a sector deployment is lawful. Those questions depend on the deployer's status, the system's Annex III point, the deployment context and the consolidated text of Article 27, applied to the facts with qualified advice. The guide also does not cover data protection impact assessment in full, which must be carried out separately where data protection law requires it. Where a fundamental-rights impact assessment may be required, confirm the scope, contents, notification and publication position with a competent authority or legal adviser before first use, and keep the assessment with the deployment file.
Frequently asked questions
Does every deployer of a high-risk system need a FRIA?
No. Article 27 applies to defined deployers, including bodies governed by public law and private providers of public services in specified Annex III areas. Scope depends on deployer type and Annex III point together, and must be checked in the consolidated text.
Must a FRIA be published?
The deployer must notify the market surveillance authority of the results and publish a summary of the findings, subject to the exceptions in Article 27. The full assessment should be kept with the deployment file.
Can an assessment replace human oversight?
No. An impact assessment identifies risks and measures, but oversight must still be exercised in practice for each consequential decision, with a competent reviewer, adequate information and recorded outcomes.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗