A fundamental rights impact assessment (FRIA) is the assessment Article 27 of the EU AI Act requires before certain deployers first use a high-risk AI system. It applies to public bodies, private entities providing public services, and deployers of credit-scoring or life and health insurance pricing systems. The results must be notified to the market surveillance authority.
Key takeaways
- The FRIA is a deployer duty, not a provider duty. It concerns how and where you use a high-risk system, not how it was built.
- It covers Annex III high-risk systems only, and excludes critical infrastructure (Annex III point 2).
- Article 27(1)(a)–(f) lists six required elements, from the processes the system is used in to complaint mechanisms if harm occurs.
- Where a GDPR data protection impact assessment already covers some elements, the FRIA complements it and can reuse that work.
- As of October 2026, the duty applies with the Annex III high-risk rules from 2 December 2027, following the Digital Omnibus.
Why the AI Act added a fundamental rights assessment
Most AI Act requirements land on providers, who cannot know every context their system will be used in. A recruitment model may be tested carefully in the lab and still disadvantage a particular group once a public employment service uses it on long-term unemployed jobseekers. The FRIA closes that gap by asking the deployer, who knows the people affected, to look at concrete harms before first use. It sits alongside the deployer duties in Article 26; see provider vs deployer obligations for how the two roles divide the work, and our EU AI Act guide for the wider framework.
Need help with cloud?
Book a free 30-minute meeting with one of our cloud specialists. We'll analyse your situation and provide actionable recommendations — no obligation, no cost.
Who must carry out a FRIA
The text is in Article 27. A FRIA is required before deploying a high-risk AI system referred to in Article 6(2), that is, an Annex III system, by three groups:
| Deployer group | Which systems | Examples |
|---|---|---|
| Bodies governed by public law | Any Annex III high-risk system except critical infrastructure (point 2) | A municipality using AI to prioritise social welfare cases; a public university using AI in admissions |
| Private entities providing public services | Same scope as above | A private hospital, a privately run school or a housing association using a high-risk system in those services |
| Deployers of Annex III point 5(b) and 5(c) systems, public or private | Creditworthiness assessment or credit scoring (fraud detection excluded); risk assessment and pricing for life and health insurance | A consumer lender using a scoring model; an insurer pricing health policies with AI |
Two practical consequences follow. First, a private company using an HR screening tool is not required to do a FRIA unless it provides a public service, although many will choose to run a lighter version anyway. Second, every bank and insurer deploying AI for credit or life and health pricing is in scope, whatever its ownership. Which systems are high-risk in the first place is explained in high-risk AI systems under Article 6 and Annex III.
If you are not yet sure which of your systems fall into these groups, Opsio's free EU AI Act readiness assessment maps your AI use in about 40 minutes and writes an AI Risk Assessment Template for your organisation, a practical base for the risk sections of a FRIA.
What a FRIA must contain: Article 27(1)(a)–(f)
The Act lists six elements. They are short in the legal text, so the right-hand column suggests what a useful answer looks like.
| Point | Required element | What a good answer includes |
|---|---|---|
| (a) | A description of the deployer's processes in which the system will be used, in line with its intended purpose | The business process step by step, where the AI output enters it, and who acts on it |
| (b) | The period of time within which, and the frequency with which, the system is intended to be used | Go-live date, expected duration, volume of decisions per month |
| (c) | The categories of natural persons and groups likely to be affected in the specific context | Applicants, customers, employees, plus vulnerable sub-groups such as people with disabilities or low digital literacy |
| (d) | The specific risks of harm likely to affect those categories, taking into account the provider's information under Article 13 | Discrimination, exclusion from services, errors in high-stakes decisions, privacy intrusion, effects on freedom of expression; each with likelihood and severity |
| (e) | A description of the human oversight measures, according to the instructions for use | Who reviews outputs, their training and authority, when they must override, how disagreement is recorded |
| (f) | The measures to be taken if those risks materialise, including internal governance and complaint mechanisms | Escalation path, suspension criteria, complaint channel for affected people, remediation and review cycle |
Point (d) is the heart of the assessment. Use the rights in the EU Charter of Fundamental Rights as a checklist: dignity, non-discrimination, privacy and data protection, freedom of expression, the rights of the child, workers' rights, access to social security and the right to an effective remedy. A consistent scoring method, such as the one in our AI risk assessment template, makes the results comparable across systems.
Timing, reuse and updates
The FRIA must be done before the system is first put into use. Under Article 27(2), the obligation applies to that first use; for similar later cases the deployer can rely on a previous FRIA or on an existing impact assessment carried out by the provider. If any of the six elements changes or is no longer up to date during use, for example the system is extended to a new group of customers, the deployer must update the assessment.
Notifying the market surveillance authority
Once the assessment is complete, Article 27(3) requires the deployer to notify the market surveillance authority of its results, submitting the filled-in template described below as part of the notification. The only exemption is the Article 46(1) case, where an authority has authorised a system for exceptional reasons such as public security or the protection of life and health, without completing conformity assessment. In practice, keep the full FRIA on file and expect the authority to ask follow-up questions.
The AI Office template
Article 27(5) instructs the AI Office to develop a questionnaire template, including through an automated tool, so deployers can comply in a simplified way. As of October 2026 we could not confirm that a final official version has been published on the Commission's AI pages, although national authorities have begun preparing for FRIA reporting. Check the AI Office pages before you submit, and in the meantime structure your FRIA around the six Article 27(1) elements so it maps cleanly onto the official template when it arrives.
How a FRIA relates to a GDPR DPIA
Most high-risk systems process personal data, so many deployers will also need a data protection impact assessment under Article 35 GDPR. Article 27(4) says that where a FRIA obligation is already met by a DPIA, the FRIA complements it, and since the Digital Omnibus amendments a deployer may cross-reference the DPIA or reuse relevant parts of it in the FRIA. You do not have to do the same work twice.
| GDPR DPIA | AI Act FRIA | |
|---|---|---|
| Legal basis | Article 35 GDPR | Article 27 AI Act |
| Who does it | Controller | Deployer in one of the three groups |
| Trigger | Processing likely to result in high risk to individuals | First use of an Annex III high-risk system |
| Focus | Rights and freedoms affected by personal data processing | All fundamental rights affected by the AI's use, including non-privacy harms |
| Authority contact | Prior consultation only if high residual risk remains | Results notified to the market surveillance authority |
A workable approach is one combined assessment with a shared description of the processing and system, and separate sections for data protection risks and for wider fundamental rights risks. Article 26(9) also lets deployers use the provider's Article 13 information when carrying out their DPIA. For a broader look at how the two laws overlap, see EU AI Act vs GDPR.
A step-by-step FRIA process
- Confirm scope. Is the system Annex III high-risk, outside point 2, and are you a public body, a public-service provider or a credit or insurance deployer?
- Collect provider information. Instructions for use, intended purpose, accuracy figures, known limitations and any provider impact assessment.
- Map the process (point a) and the period and frequency of use (point b).
- Identify affected people (point c), involving front-line staff and, where possible, representatives of affected groups.
- Assess risks of harm (point d) right by right, with likelihood and severity.
- Define human oversight (point e) with named roles and training.
- Plan the response (point f): suspension triggers, complaints, remediation.
- Link to the DPIA and cross-reference rather than duplicate.
- Approve, notify and file. Senior sign-off, notification to the authority, then set a review date.
Frequently asked questions
Who needs to do a fundamental rights impact assessment under the AI Act?
Deployers of Annex III high-risk AI systems that are bodies governed by public law or private entities providing public services, and any deployer using AI for creditworthiness assessment, credit scoring, or risk assessment and pricing in life and health insurance. Critical infrastructure systems under Annex III point 2 are excluded. Providers do not carry out a FRIA.
When does the FRIA requirement apply?
The FRIA belongs to the Annex III high-risk obligations. After the Digital Omnibus, Regulation (EU) 2026/1744, those apply from 2 December 2027, as of October 2026. Public-authority deployers of high-risk systems already in use have until 2 August 2030. The assessment must be done before first use of the system.
Is a FRIA the same as a DPIA?
No. A DPIA under GDPR focuses on risks from processing personal data, while a FRIA covers all fundamental rights affected by an AI system's use, such as non-discrimination and access to services. Article 27(4) says the FRIA complements a DPIA, and as amended by the Digital Omnibus it lets you cross-reference the DPIA or reuse its relevant parts where they already meet a FRIA element.
Is there an official FRIA template?
The AI Act requires the AI Office to develop a questionnaire template, possibly as an automated tool, and deployers submit it with their notification. As of October 2026 we could not confirm a final published version, so check the AI Office pages. Structuring your assessment around the six Article 27(1) elements makes it easy to transfer.
Do we have to redo the FRIA every time we use the system?
No. It applies to first use, and for similar cases you can rely on a previous FRIA or a provider's impact assessment. You must update it when any of the six required elements changes or becomes out of date, such as new affected groups, a new process or materially different use.
Start your FRIA with the groundwork done
A FRIA is far easier when you already know which systems you run, who owns them and how you assess risk. Opsio's free AI governance assessment takes about 40 minutes and writes four editable Word documents from your answers: an AI Governance Framework, an AI Acceptable Use Policy, an AI Vendor Due Diligence Checklist and an AI Risk Assessment Template, plus a maturity score across ten governance areas. Free, with no card and no obligation.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Statements are accurate as of October 2026.
Written By
Country Manager, India
Praveena leads Opsio's India operations, bringing 17+ years of cross-industry experience spanning AI, manufacturing, DevOps, and managed services.
Editorial standards: This article was written by cloud practitioners and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates on this page show the latest update. Opsio maintains editorial independence.