The fundamental rights impact assessment is one of the AI Act obligations that falls not on the maker but on the user. It requires certain deployers, before using a high-risk system, to examine systematically whom the system may affect and how.
Who must carry it out
Under Article 27 of the AI Act, the obligation applies to deployers that are bodies governed by public law or private entities providing public services, when they use high-risk systems under Annex III. It also applies to deployers of systems for assessing the creditworthiness of natural persons and for risk assessment and pricing in life and health insurance. An ordinary company using a high-risk system in HR is not automatically covered, but it has the other deployer obligations.
What it contains
A description of the processes in which the system is used, the period and frequency of use, the categories of people and groups affected, the specific risks of harm to them taking into account the provider’s information, the human oversight measures, and the measures to take if risks materialise, including internal governance and complaint mechanisms. The result must be notified to the market surveillance authority; the Commission’s AI Office provides a template.
FRIA and DPIA
The data protection impact assessment under the GDPR asks about risks to data subjects’ rights from processing personal data. The FRIA asks more broadly about fundamental rights, such as non-discrimination, access to services or freedom of expression, even where personal data is not central. Where a DPIA exists, the FRIA complements rather than replaces it. In practice it pays to produce both in one process.
Timing
The FRIA is tied to the Annex III high-risk obligations, which apply from December 2027 following the Digital Omnibus. Anyone already using or introducing an affected system gains nothing by waiting: the FRIA’s content is what must be clarified for a responsible rollout anyway, and preparation takes time because business units, data protection and legal are all involved.
Implementation
A FRIA is not a form one person fills in. It needs the business side that knows the process, the provider’s information on the system’s limits and risks, and an owner for the measures. Our FRIA and DPIA package brings both assessments together.