Fundamental Rights Impact Assessment (FRIA)
A FRIA (Article 27) is an assessment certain deployers of high-risk AI — public bodies and providers of essential private/public services — must complete before first use, documenting how the deployment could affect people's fundamental rights and how risks are mitigated.
Article 27 sets the required content: a description of the deployer's processes in which the system will be used, the period of time and frequency of intended use, the categories of natural persons and groups likely to be affected, the specific risks of harm likely to affect them, a description of the human-oversight measures to be implemented, and the measures to be taken if those risks materialise, including internal governance and complaint mechanisms. The deployer must notify the market-surveillance authority of the results, and where any element is already met through a GDPR data protection impact assessment, the FRIA complements that assessment rather than duplicating it.
- Art. 27
- Art. 26
Fundamental Rights Impact Assessment (FRIA): why it matters
The FRIA is the point where the Act asks a deployer to look outward at the people affected rather than inward at its own risk. It has to be done before first use, not alongside rollout, and the notification to the authority makes it visible — which means a thin FRIA is a document a regulator has already seen before it ever asks a question. It is also scoped narrowly, so the first task is establishing whether you are actually in the group that owes one.
Fundamental Rights Impact Assessment (FRIA) in practice
A municipality deploys an AI system to prioritise social-housing applications. Its FRIA has to identify the affected groups concretely — applicants with irregular income, non-native speakers, people with disabilities — name the specific harms such as systematic deprioritisation, describe who reviews flagged cases and with what authority, and set out what happens when a harm materialises, including how a resident complains and who acts on it. It then notifies the market-surveillance authority of the results.
Fundamental Rights Impact Assessment (FRIA): the mistake people make
Filing the GDPR DPIA and considering the FRIA done. They ask different questions: the DPIA is about risks to data subjects from processing personal data, the FRIA about impacts on fundamental rights from the deployment. Article 27 says the FRIA complements the DPIA — overlapping elements need not be repeated, but the assessment is not discharged.
Fundamental Rights Impact Assessment (FRIA): common questions
- Who has to carry out a FRIA?
- Deployers that are bodies governed by public law or private entities providing public services, and deployers of Annex III systems used to evaluate creditworthiness or establish credit scores, or for risk assessment and pricing in life and health insurance.
- When must the FRIA be completed?
- Before the high-risk AI system is put into use for the first time. Where any element changes, the deployer must update the assessment, and it notifies the market-surveillance authority of the results.
- Is a FRIA the same as a GDPR DPIA?
- No. A DPIA assesses risks to data subjects arising from personal-data processing; a FRIA assesses the impact of the deployment on fundamental rights more broadly. Article 27 states the FRIA complements the DPIA, and elements already covered need not be duplicated.
Fundamental Rights Impact Assessment (FRIA): terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.