Fundamental rights impact assessment (FRIA): who needs one and what goes in it
Article 27 of the EU AI Act requires some deployers of high-risk AI to assess the impact on fundamental rights before first use. This page sets out who, when and the six elements, with a template that maps each element to the evidence an AI risk register already holds.
As at 1 November 2026. This page is not legal advice: read Article 27 against the facts of your own case.
Who must carry one out
The duty covers high-risk AI systems listed in Annex III, other than critical infrastructure (point 2), and three groups of deployers:
- bodies governed by public law;
- private entities providing public services;
- deployers of the systems in Annex III, point 5(b), which evaluate the creditworthiness of natural persons or establish their credit score (fraud detection excepted), and point 5(c), which do risk assessment and pricing in life and health insurance.
For lenders and insurers, points 5(b) and (c) are the trigger. A lender that builds its own credit scoring model and uses it is also its provider, with the provider's duties, including the risk management system of Article 9. See EU AI Act obligations by role and date.
When
Before first use, from 2 December 2027, when the AI Act's rules for Annex III systems apply. The assessment applies to the first use and may rely on earlier assessments or on the provider's impact assessments in similar cases. Its information is updated when an element changes or is no longer up to date (Article 27(2)). The deployer then notifies the market surveillance authority of the results on the AI Office's questionnaire template (Article 27(3) and (5)), with an exemption in the case of Article 46(1).
The six elements, and where the evidence comes from
The left two columns follow Article 27(1). The right two say what to record and where the method in the book already holds it, so that one record serves the register, the DPIA and the FRIA.
| Element | What the Act asks for | What to record | Evidence from the register and templates |
|---|---|---|---|
| 27(1)(a) | A description of the deployer's processes in which the system will be used, in line with its intended purpose | The business process, the decisions the system supports and the purpose the provider states | Inventory fields 1, 4 and 5; the use-case header |
| 27(1)(b) | The period within which, and the frequency with which, each system is intended to be used | Start date, how long it will run, and the volume and frequency of decisions | Inventory field 13; template field 6 |
| 27(1)(c) | The categories of natural persons and groups likely to be affected in the specific context | Applicants, customers, employees or citizens, with vulnerable groups flagged | Inventory field 6; the harmed column of the register |
| 27(1)(d) | The specific risks of harm likely to affect those categories, taking account of the provider's information under Article 13 | Each risk of harm to those groups, scored on harm to individuals, citing the provider's documentation | The register lines for discrimination and harm to people: FAI-01, FAI-02, FAI-03, FAI-04, FAI-05, FAI-06, FAI-07, HUM-08, LEG-01, LEG-02 |
| 27(1)(e) | A description of the implementation of human oversight measures, according to the instructions for use | Who oversees the system, with what authority and training, and how an override works | Inventory field 5; template field 8; the human oversight lines: HUM-01, HUM-05, HUM-07 |
| 27(1)(f) | The measures to be taken if those risks materialise, including internal governance and complaint mechanisms | Escalation, suspension and redress, and the complaints channel with its owner | Recovery controls, owners and indicators; the complaints indicator of Chapter 13: TRA-02 |
FRIA and DPIA
Most systems that need a FRIA also process personal data, so a data protection impact assessment under Article 35 of the GDPR is usually due as well, and that duty applies already. The AI Act directs deployers to use the provider's information for the DPIA (Article 26(9)). Where the DPIA already covers an element of the FRIA, the FRIA complements it, and since the 2026 amendments the deployer may cross-refer to the DPIA rather than repeat it (Article 27(4)).
If it is missed
Article 27 is not among the obligations listed in Article 99(4), so the penalty for a missing FRIA is set by national law (Article 99(1)), except where the AI Office supervises the system and can fine any infringement at the Article 99(4) level (Article 75c(4)).
Questions about the FRIA
Is there an official FRIA template?
The AI Office is to develop a questionnaire template, including through an automated tool, for deployers to fill in and send to the market surveillance authority (Article 27(5), as amended in 2026). I had not found a published template by 1 November 2026. Until there is one, record the six elements of Article 27(1) in a form you can transfer to it.
Does a bank need a FRIA for credit scoring?
Yes, if it deploys a high-risk AI system to evaluate the creditworthiness of natural persons or establish their credit score, which Annex III point 5(b) lists; systems used to detect financial fraud are excepted. The same applies to insurers deploying AI for risk assessment and pricing in life and health insurance (point 5(c)). The duty applies from 2 December 2027.
What is the difference between a FRIA and a DPIA?
A data protection impact assessment under Article 35 of the GDPR looks at the risks of processing personal data. A FRIA under Article 27 of the AI Act looks at the impact of a high-risk AI system on the fundamental rights of the people it affects, which reaches beyond data protection. Where a DPIA already covers an element, the FRIA complements it, and since the 2026 amendments the deployer may cross-refer to the DPIA (Article 27(4)).
When must a FRIA be carried out?
Before the deployer first uses the system. It applies to the first use, it may rely on earlier assessments or the provider's impact assessments in similar cases, and its information must be updated when an element changes or is no longer up to date (Article 27(2)).
Who receives the FRIA?
The deployer notifies the market surveillance authority of the results, using the filled-out template (Article 27(3)). For high-risk AI used by financial institutions in providing financial services, that authority is normally the national financial supervisor (Article 74(6)).
The template in Excel
The free workbook has a FRIA sheet that maps the six elements to the register columns and to the fields of the AI system inventory and the use-case template, beside the 91-line register itself.
Get the FRIA template and the book
Your files are ready. The links are personal to your email address and work for 7 days. A copy is on its way to your inbox.
Start with Chapter 1, then Appendix A for the register. Questions about the method are welcome at rory@eonriskservices.com.