A fundamental rights impact assessment (FRIA) is a mandatory, structured evaluation to identify, assess and mitigate the impact of a high-risk AI system on fundamental rights. If your firm uses AI in decision-making, it is worth knowing about, even though not every firm is covered by it. The obligation is set out in Article 27 of the AI Act and applies only in specific situations, not to every AI system.
What does fundamental rights impact assessment mean?
The fundamental rights impact assessment, abbreviated to FRIA, is laid down in Article 27 of Regulation (EU) 2024/1689, better known as the EU AI Act. The obligation applies from 2 December 2027, together with the other obligations for the high-risk systems listed in Annex III.
For the FRIA, the distinction between deployer and provider matters. The provider is the organisation that builds an AI system and places it on the market. The deployer is the organisation that actually uses the system under its own authority. The FRIA obligation lies with the deployer, not the provider. A firm that uses an AI tool from an external supplier is therefore itself responsible for the FRIA, even though it did not build the system.
When is a FRIA mandatory?
A FRIA is mandatory when you, as a deployer, use a high-risk AI system from Annex III of the AI Act and you are a body governed by public law or a private entity providing public services. Any other deployer only falls under it when using AI to assess the creditworthiness of natural persons, or for risk assessment and pricing in life and health insurance (Annex III, point 5(b) and (c)). A private employer that uses AI for hiring decisions has no FRIA obligation.
For a private firm that does not provide public services, such as an accountancy firm, the obligation only comes into play with those two applications. One example is an AI tool that assesses the creditworthiness of a client who is a natural person, or assigns a credit score. Under point 5(b), AI used only to detect financial fraud falls outside that category. An AI tool that helps decide on client acceptance or produces an internal risk classification does not bring a private firm under the FRIA obligation, as long as that tool does not assess the creditworthiness of natural persons.
Article 99(4) does not link the maximum fine of 15 million euros or 3 per cent of worldwide annual turnover to Article 27. Penalties for a missing FRIA are set by the member states under Article 99(1).
Who has to carry out a FRIA?
A FRIA applies specifically to deployers of high-risk AI systems as defined in Annex III. The obligation primarily affects public bodies and private organisations that provide public services, such as education, healthcare, housing and social services.
For most accountancy and advisory firms, the question is less of a grey area than it seems. Outside the two applications in point 5, a private firm does not fall under it, while in practice a DPIA becomes relevant much sooner. If you use AI for other decisions that affect clients, such as client acceptance or risk classification, you can voluntarily carry out an assessment along the lines of a FRIA. That way you record which fundamental rights could be affected and which measures you are taking, even though the AI Act does not require it in that situation.
FRIA versus DPIA and AIIA: how do they differ?
A FRIA differs from a privacy assessment such as the DPIA and from a broader AIIA in its scope and legal basis. A DPIA focuses on privacy risks under the GDPR and is relevant as soon as you process personal data. An AIIA is a broader evaluation of fairness, bias and societal impact that is not required by law. A FRIA is the legally required variant specific to fundamental rights, under Article 27 of the AI Act, solely for deployers of high-risk AI systems.
- Focus: privacy risks
- Basis: GDPR
- For: anyone processing personal data
- Focus: fairness, bias, societal impact
- Basis: not required by law
- For: any organisation, voluntarily
- Focus: fundamental rights
- Basis: AI Act, Article 27
- For: deployers of high-risk AI systems
The instruments complement each other: a DPIA can feed into a FRIA but does not replace it.
These instruments are not mutually exclusive. A DPIA you have already carried out can partly serve as input for a FRIA: you do not have to reassess overlapping risks from scratch. Even so, a DPIA does not replace a FRIA. Whatever a DPIA does not cover, such as the wider impact on the fundamental rights of groups that are not directly visible in the data, you still have to include separately in the FRIA.
How do you carry out a fundamental rights impact assessment?
A fundamental rights impact assessment follows a fixed pattern and has to be completed before you put the AI system into use.
Start with a description of the AI system: what it does, which decisions it makes and who those decisions are meant for. In the next step, identify which fundamental rights could be affected, such as non-discrimination, privacy or access to a fair procedure. Then map out which groups of people are affected, paying extra attention to groups that are more vulnerable to negative outcomes.
Next, estimate the risk and decide which mitigating measures are needed, both technical and organisational. Document the whole process carefully, preferably with a team that knows the basic concepts. Lastly, notify the competent market surveillance authority of the outcome. In the Netherlands, under the proposed Dutch implementing act (not yet in force), that will be the existing regulator in your sector, with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) covering areas without a regulator of their own.
Frequently asked questions about the FRIA
Once you know whether a FRIA is mandatory, practical questions often follow about how to carry it out and about the supplier’s role.
Do you have to repeat a FRIA every time you use the system?
No, you carry out a FRIA before the first use of a high-risk AI system, not every time you use it. Under Article 27(2) of the AI Act, in similar cases you may rely on a previous FRIA or on an existing assessment by the provider. If any of the assessed elements changes during use, or the information is no longer up to date, you update the FRIA.
Is there a FRIA template?
An official FRIA template is due to come from the European Commission’s AI Office, which under Article 27(5) of the AI Act is developing a questionnaire, including in the form of an automated tool. The template must allow you to refer to or include parts of an existing DPIA. Under paragraph 3, you submit the completed template when you notify the market surveillance authority.
What is the difference between a FRIA and a conformity assessment?
A FRIA and a conformity assessment differ in who carries them out and what they assess. The conformity assessment is an obligation of the provider, who demonstrates before placing a high-risk AI system on the market that it meets the requirements of the AI Act, resulting in an EU declaration of conformity and CE marking. The deployer carries out the FRIA before first use, and it looks at the consequences for fundamental rights in the deployer’s own application.
How do you take a first step towards a FRIA?
Not sure whether you need a FRIA? Then first map out which AI systems you use and whether any of them comes close to a high-risk classification under Annex III, before you start on a full FRIA. The AI Literacy Course covers the risk categories of the AI Act.
That way you avoid spending time on an extensive FRIA for a system that does not actually fall under it, or overlooking an obligation because you had not assessed the risk level.
