Under Article 27, deployers that are bodies governed by public law, private entities providing public services, and deployers of systems in Annex III points 5(b) and 5(c) concerning creditworthiness and life and health insurance, must, before first use of a high-risk system under Article 6(2) except for Annex III point 2 systems, carry out a fundamental rights impact assessment. The assessment must contain the elements Article 27 sets out, must be notified to the market surveillance authority using the AI Office template, and must be updated where any element changes.
Who must carry out a FRIA?
The FRIA duty applies to a defined set of deployers, not to every deployer of a high-risk system. In outline, it applies to deployers that are bodies governed by public law, to private entities providing public services, and to deployers of high-risk systems referred to in Annex III points 5(b) and 5(c), concerning creditworthiness or credit scoring and risk assessment and pricing for life and health insurance. It applies to high-risk systems under Article 6(2), except for systems intended for the area in Annex III point 2, concerning critical infrastructure. A deployer should record, for each high-risk deployment, whether it falls within the FRIA categories, the basis for the conclusion, and the reviewer. A deployer that is outside the categories should still consider whether a rights assessment is useful as good governance, but should not present it as an Article 27 FRIA where the duty does not apply, and should not omit a FRIA where it does.
What must a FRIA contain?
Article 27 requires the assessment to consist of, in outline, a description of the deployer's processes in which the system will be used in line with its intended purpose, a description of the period and frequency of intended use, the categories of natural persons and groups likely to be affected, the specific risks of harm likely to affect those categories, taking into account the information given by the provider under Article 13, a description of human oversight measures according to the instructions for use, and the measures to be taken if the risks materialise, including internal governance and complaint mechanisms. Each element should be addressed on the facts of the specific deployment, not in general terms, and should be supported by evidence, such as the provider's instructions, the deployment workflow, and the oversight design. A FRIA that copies the provider's generic description without applying it to the deployer's processes, people, and context has not carried out the assessment Article 27 requires.
For the broader regulatory framework, see AI governance planning checklist.
How should the assessment be carried out step by step?
A practical sequence starts with scoping: confirm the system, the intended purpose, the deployer category, and the Annex III point. Next, describe the deployment processes, the period and frequency of use, and the affected people and groups, including groups at particular risk. Next, identify the specific risks of harm to those groups, using the provider's Article 13 information, the risk management file where available, and the deployer's own knowledge of its processes. Next, describe the oversight measures and the governance and complaint mechanisms that will apply if risks materialise. Next, record the measures to be taken, the owners, and the review date, and obtain approval from a person with authority to decide on deployment. Finally, notify the market surveillance authority as Article 27 requires, using the template the AI Office develops, subject to the exemption in Article 46(1) where it applies. Each step should be dated and recorded, so that the assessment can be followed from scoping to notification.
How does a FRIA relate to a data protection impact assessment?
Where an obligation in Article 27 is already met through a data protection impact assessment under Article 35 of the General Data Protection Regulation or Article 27 of Directive (EU) 2016/680, the FRIA must complement that assessment, as Article 27 provides, and the deployer may cross-reference or include the relevant parts. Regulation (EU) 2026/1744 clarified that cross-referencing, and the AI Office is to develop a questionnaire template, including an automated tool, to facilitate compliance. The deployer should map the DPIA and the FRIA together, showing which FRIA elements are covered by the DPIA, which need additional work, and where the FRIA goes beyond privacy to other fundamental rights, such as non-discrimination, freedom of expression, and the rights of the child. A DPIA alone does not automatically satisfy the FRIA, and a FRIA alone does not satisfy a DPIA, and the mapping should show the relationship explicitly rather than assuming one covers the other.
When must a FRIA be updated and notified?
The FRIA obligation applies at first use, and the deployer may rely on a previous FRIA or an existing provider assessment in similar cases, as Article 27 provides. Where, during use, the deployer considers that any element in the assessment has changed or is no longer up to date, it must take the necessary steps to update the information. Updates should be triggered by changes in processes, purpose, period or frequency, affected groups, risks, oversight, or governance, and should be recorded as new versions with the date and reason. Once the assessment has been performed, the deployer must notify the market surveillance authority of the results, submitting the filled-out template, subject to the exemption in Article 46(1). The notification record, including the date, the authority, and the template version, should be kept with the FRIA file, so that the notification can be shown to have been made.
Continue with Who must comply with the EU AI Act.
What does this guide not decide?
This guide does not decide whether a particular deployer must carry out a FRIA, whether an assessment meets Article 27, or whether a DPIA covers a FRIA element. It does not assess a risk of harm, an oversight measure, or a complaint mechanism. Those questions depend on the deployer's status, the system, the deployment context, the affected people, and the consolidated legal text, including Article 27 as amended. A deployer should confirm its FRIA position with a competent authority or legal adviser, carry out the assessment on the facts of its deployment, and keep the assessment and notification under review as the deployment changes.
Frequently asked questions
Must every deployer carry out a FRIA?
No. Article 27 applies to defined deployers: bodies governed by public law, private entities providing public services, and deployers of Annex III points 5(b) and 5(c) systems, for Article 6(2) high-risk systems except Annex III point 2. Each deployment should be assessed against those categories, with the basis recorded.
Can a DPIA replace a FRIA?
No, not automatically. Where a DPIA already meets an Article 27 obligation, the FRIA must complement it, and the deployer may cross-reference or include the relevant parts. The mapping should show which FRIA elements are covered by the DPIA and which need additional rights work beyond privacy.
When is a FRIA notified?
Once the assessment has been performed, the deployer must notify the market surveillance authority of the results, submitting the filled-out AI Office template, subject to the exemption in Article 46(1). The notification date, authority and template version should be recorded in the FRIA file.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗