EU AI Act Article 27: Fundamental Rights Impact Assessment (FRIA)

Who Must Carry Out a FRIA

The FRIA obligation falls on a defined set of deployers of high-risk AI systems, not on providers and not on every deployer:

• Bodies governed by public law, and private entities providing public services, when they deploy high-risk AI systems
• Deployers of Annex III credit-scoring systems — high-risk AI used to evaluate creditworthiness or establish a credit score (excluding fraud detection)
• Deployers of Annex III insurance systems — high-risk AI used for risk assessment and pricing in life and health insurance
• The assessment must be completed before the system is put into use

Where a Data Protection Impact Assessment under GDPR Article 35 already covers some of the same ground, the FRIA can build on it rather than duplicate it.

What the Assessment Must Cover

Article 27(1) sets out the elements a FRIA must describe:

• A description of the deployer's processes in which the high-risk system will be used, in line with its intended purpose
• The period and frequency over which the system is intended to be used
• The categories of natural persons and groups likely to be affected in the specific context
• The specific risks of harm likely to impact those categories of persons
• A description of the human-oversight measures in place, per the instructions for use
• The measures to take if risks materialise, including internal governance arrangements and complaint mechanisms

Notifying the Authority

The FRIA is not a purely internal exercise — its results are reported to the regulator:

• Once the assessment is performed, the deployer notifies the market surveillance authority of its results
• The AI Office is tasked with developing a template questionnaire to help deployers comply in a simplified way
• The FRIA must be updated if any of its elements change or are no longer up to date during the period of use
• It complements, and does not replace, the provider's own conformity and risk-management obligations