The fundamental rights impact assessment, or FRIA, is one of the least understood duties of the EU AI Act. It is set out in Article 27 and addresses not providers of AI systems but certain deployers. Anyone deploying a high-risk AI system may have to assess, before it goes live, what impact the deployment has on the fundamental rights of affected people. Many organisations overlook this duty because they assume the manufacturer’s conformity assessment settles everything. That is an expensive mistake.
Who must carry out a FRIA
Article 27 expressly addresses deployers that are public bodies or private entities providing public services, as well as deployers of high-risk systems in two sensitive areas: creditworthiness assessment of natural persons, and risk assessment and pricing in life and health insurance. A municipality using an AI system to allocate social benefits, a bank with automated scoring or an insurer with AI-supported pricing fall within scope. Purely private companies outside these fields are not directly subject to the FRIA duty, but often to the parallel data protection impact assessment under Article 35 GDPR. For Swiss companies: once you operate such a system for the EU market or affect people in the EU, the AI Act applies extraterritorially.
What belongs in a robust FRIA
Article 27(1) names the minimum content: a description of the deployer’s processes in which the system is used; the period and frequency of use; the categories of natural persons and groups likely to be affected; the specific risks of harm to them, taking account of the provider’s information; the human oversight measures according to the instructions for use; and the measures taken if the risks materialise, including internal governance and complaint mechanisms. Keep the FRIA as a living document, structured in blocks such as context and purpose, affected rights, risk analysis, mitigation and residual risk with a release decision, each with an owner and review date.
The interface with the DPIA
In most real cases a high-risk system also processes personal data, so a DPIA runs alongside the FRIA. Article 27(4) expressly allows the FRIA to complement an existing DPIA rather than duplicate it. Build an integrated assessment in which the DPIA covers the data protection perspective and the FRIA the broader fundamental rights dimension: non-discrimination, freedom of expression, human dignity, effective remedy. Duplication is not only inefficient but produces contradictory versions that can be used against you in an audit.
Common mistakes
First, starting too late: the FRIA must exist before first use. Second, keeping the risk analysis abstract: “there is a risk of discrimination” is worthless; robust is a statement that names the mechanism, the affected group and the mitigation. Third, providing no meaningful human decision although Article 14 requires oversight for high-risk systems. Fourth, forgetting to notify the market surveillance authority of the results, as Article 27 requires.
Timeline and next steps
Following the Digital Omnibus, high-risk duties for Annex III systems apply from 2 December 2027. Anyone planning an affected system should set up the FRIA method now, because it concerns training data, oversight design and complaint channels that must be built into the architecture. Start with a one-page inventory: which AI systems do we use, which fall under Annex III, and for which are we deployers within the meaning of Article 27? The result is the list of systems requiring a FRIA. The duty is explained further in our glossary entry on the fundamental rights impact assessment; our FRIA and DPIA package combines both assessments.