European Union
EU AI Act Article 27: The Fundamental Rights Impact Assessment (FRIA)
Not every deployer has to run a fundamental rights impact assessment, but the ones that do must complete it before first use and notify the regulator. Here is who is covered and what it has to contain.
Timing note: The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the application date for standalone Annex III high-risk systems from August 2, 2026 to December 2, 2027, and for high-risk systems embedded in Annex I products to August 2, 2028. See our implementation timeline for what applies today.
The fundamental rights impact assessment, or FRIA, is one of the few obligations in the EU AI Act that falls only on some deployers. That makes it easy to assume it applies to everyone, or to no one. Article 27 is precise about who is in, and the answer depends on what kind of organization you are and what the system is used for.
Who must complete one
Three groups of deployers must carry out a FRIA before first using a high-risk system referred to in Article 6(2), meaning an Annex III system:
- Bodies governed by public law.
- Private entities providing public services.
- Deployers of high-risk systems used to evaluate the creditworthiness of natural persons or establish their credit score, and of systems used for risk assessment and pricing in life and health insurance (Annex III, points 5(b) and 5(c)).
Systems in the critical infrastructure area of Annex III, point 2, are excluded from the requirement. For later uses of the same system, a deployer may rely on a previous FRIA or on an impact assessment already carried out by the provider, in similar cases.
That scope surprises people in both directions. A private employer using a CV-ranking tool is a deployer of a high-risk system but is not, on the face of Article 27, required to run a FRIA, although it still has the Article 26 duties. A bank using a credit-scoring model is squarely in.
What the assessment must contain
Article 27(1) lists six elements. The assessment must include:
- A description of the deployer's processes in which the system will be used, in line with its intended purpose.
- The period of time within which, and the frequency with which, the system is intended to be used.
- The categories of natural persons and groups likely to be affected by its use in the specific context.
- The specific risks of harm likely to affect those categories of persons or groups, taking into account the information the provider gave the deployer under Article 13.
- A description of how human oversight measures will be implemented, according to the provider's instructions for use. See Article 14.
- The measures to be taken if those risks materialize, including internal governance arrangements and complaint mechanisms.
If any element changes or becomes outdated during use, the deployer must update the information.
Telling the regulator
After performing the assessment, the deployer must notify the market surveillance authority of its results, submitting a filled-out template. The Act tasks the AI Office with developing a template questionnaire, which may include an automated tool, to make compliance simpler. Notification can be waived only in the exceptional case referred to in Article 46(1).
How it fits with a GDPR DPIA
A FRIA is not a replacement for a data protection impact assessment. The Act says that where a DPIA under GDPR Article 35 already covers some of the Article 27 obligations, the deployer may cross-reference it or include relevant parts, and the FRIA complements it. In practice, teams that already run DPIAs for AI systems should expect to reuse the description of processing and the risk analysis, and add the parts a DPIA does not ask about: the groups affected beyond data subjects, and the complaint mechanisms. See how the EU AI Act and GDPR overlap.
What to do now
There is time, but the dependencies run backward from the deadline. The assessment draws on the provider's instructions and Article 13 information, so contract for that information now. Decide who owns the assessment internally (legal, risk or the business owner of the system), and settle the format so it can later be mapped to the AI Office template once published. We have summarized Article 27 from the official text; check the regulation and the final template before relying on a specific detail.
See every upcoming date on our AI compliance deadlines calendar.
Frequently asked questions
- What is a fundamental rights impact assessment under the EU AI Act?
- A structured assessment a deployer must complete before first using certain high-risk AI systems. It describes how the system will be used, who it may affect, the specific risks of harm to those people, how human oversight will work, and what the deployer will do if the risks materialize.
- Who has to do a FRIA?
- Deployers that are bodies governed by public law, private entities providing public services, and deployers of high-risk systems used for creditworthiness assessment and for risk assessment and pricing in life and health insurance (Annex III, points 5(b) and 5(c)). Systems in the critical infrastructure area of Annex III, point 2, are excluded.
- Is a FRIA the same as a GDPR data protection impact assessment?
- No, but they overlap. Where a DPIA already covers some of the required elements, the deployer may cross-reference it or include relevant parts, and the FRIA then complements it. A DPIA looks at risks to personal data; a FRIA looks at the broader impact on fundamental rights.
- Does the deployer have to send the FRIA to the regulator?
- The deployer must notify the market surveillance authority of the results, using a template questionnaire that the AI Office is tasked with developing. Notification may be waived in the exceptional case referred to in Article 46(1).
- When does Article 27 apply?
- For Annex III high-risk systems, from December 2, 2027, after the Digital Omnibus on AI moved the original August 2, 2026 date.
Sources & references
Suggested next reading
regulations eu