A fundamental rights impact assessment (FRIA) is the analysis that Article 27 of the AI Act requires certain deployers to carry out before they first use a high-risk AI system. It sets out what the system will be used for, who it affects, what harm it could do to their rights and how it is monitored. It becomes mandatory on 2 December 2027, the date the Digital Omnibus set for the Annex III high-risk obligations.
It is carried out by the organisation that uses the system, not by the one that develops it. And not everyone using a high-risk system is required to do one.
Who has to carry out a FRIA
Article 27(1) of Regulation (EU) 2024/1689 requires it from three groups of deployers of Annex III high-risk systems:
- Bodies governed by public law, such as ministries, local councils, public universities or the health service.
- Private entities providing public services, for example a transport concession holder, a water utility or a publicly funded private school.
- Any company that uses AI to assess the creditworthiness of individuals or establish their credit score (except to detect fraud), or for risk assessment and pricing in life and health insurance. These are points 5(b) and 5(c) of Annex III.
Systems under point 2 of Annex III, critical infrastructure, are excluded even though they are high-risk.
One case worth being clear about: a private company that uses AI to screen CVs has a high-risk system (point 4 of Annex III), but it is not required to carry out a FRIA unless it provides a public service. We would still do it. The questions Article 27 asks are the same ones a rejected applicant or an inspector will ask, and answering them costs little more than the inventory work.
What it has to include
Article 27(1) lists six elements. In practical terms:
- Which of the organisation's processes the system is used in and for what, in line with its intended purpose.
- How long and how often it will be used.
- Which people and groups may be affected in that specific use.
- What risks of harm it poses to them, taking into account the information the provider gives in the instructions for use (Article 13).
- How human oversight is applied.
- What will be done if the risks materialise, including internal governance and the complaints mechanism.
Our advice on the fifth point: writing that "a person reviews the decisions" is not enough. You need to say who, using what criteria and whether they can overturn them. If human oversight has not been designed beforehand, the FRIA will expose it.
FRIA and DPIA: what you can reuse
If the system processes personal data, there is very likely already a data protection impact assessment (DPIA) under Article 35 of the GDPR. Article 27(4), as amended by the Omnibus, lets the FRIA refer to that DPIA or incorporate parts of it. You do not need to repeat the work, but the DPIA on its own is not enough either.
| DPIA (GDPR) | FRIA (AI Act) | |
|---|---|---|
| What it protects | People's rights in relation to their personal data | All fundamental rights: equality, non-discrimination, access to services, effective remedy, as well as privacy |
| Who carries it out | The controller | The deployer, if it belongs to one of the groups in Article 27(1) |
| When | Before processing likely to result in a high risk | Before the high-risk system is first used |
| Who is notified | The supervisory authority, only if the risk remains high (prior consultation under Article 36) | The result is always notified to the market surveillance authority |
The real difference is in the first row. A scoring system can be fully GDPR-compliant and still reject people over a certain age more often. A DPIA does not capture that, and it is exactly what the FRIA is looking for.
When it is done and when it is updated
It is done before first use and updated whenever something it covers changes: the purpose, the affected groups, the model or the oversight measures. Article 27(2) allows you to rely on earlier assessments or on those carried out by the provider for similar cases, as long as they are reviewed for your own use.
Once completed, the result is notified to the market surveillance authority using a questionnaire template that the AI Office has to publish (Article 27(5)). When we last reviewed this article, the official template had not yet been published on the Commission's website, so it makes sense to prepare the FRIA around the six elements in the article and transfer it to the questionnaire once it is available.
How we approach it
We treat it as one more part of each AI system's record, not as a separate document written once and forgotten:
- Start from the AI system inventory and flag the systems that need one, using the three questions above.
- Pull up the DPIA for the same system and see which sections can be cited.
- Assess each affected right on the same likelihood and impact scale as the company's other risks, so the AI committee can compare them.
- Give human oversight a named owner and measure it with an indicator, such as the percentage of decisions reviewed by a person.
- Schedule a review for whenever the model or its use changes.
In GlobalSuite® AI Governance the FRIA is run as a survey on each system in the inventory: every affected right is rated by likelihood and impact, and the AI agent compares the system with similar ones and suggests any rights that are missing. The report is generated from a template using the data already in the system record.
If you are just getting started with the Regulation, the AI Act page has the timeline and shows how the other high-risk obligations fit together.
