The AI Act places most obligations on providers of AI systems. The fundamental rights impact assessment is an exception: it falls on deployers, the organisations using a high-risk AI system, because only at deployment does it become clear whom the system affects and how.
Who must carry it out
Deployers that are bodies governed by public law or private entities providing public services, and deployers of certain Annex III systems, in particular for assessing the creditworthiness of natural persons and for risk assessment and pricing in life and health insurance. Under the Digital Omnibus, obligations for Annex III high-risk systems apply from 2 December 2027.
What it contains
A description of the processes in which the system is used, period and frequency of use, the categories of persons and groups affected, the specific risks of harm to them, the human oversight measures and the arrangements if risks materialise, including internal governance and complaint mechanisms. The result is notified to the market surveillance authority.
Relation to the DPIA
Where a data protection impact assessment under the GDPR or FADP has already been carried out, the FRIA complements it rather than repeating it. The DPIA looks at risks to personal data protection, the FRIA more broadly at fundamental rights such as non-discrimination, access to services or legal remedies. How to combine both is described in our article FRIA and DPIA.
Relevance for Switzerland
Swiss companies are affected when they deploy a high-risk system in the EU or its output is used there. For a Swiss insurer with EU customers or a lender with business in Germany the question is concrete.