Fundamental rights impact assessment (FRIA)

Article 27 of the EU AI Act requires a fundamental rights impact assessment (FRIA) from deployers that are bodies governed by public law, private entities providing public services, and deployers of high-risk systems used to evaluate creditworthiness or to assess risk and set conditions for life and health insurance. Systems used for critical infrastructure are excluded. The assessment describes the processes in which the system will be used, the period and frequency of use, the categories of people likely to be affected, the specific risks of harm to them, the human oversight measures and the measures to be taken if those risks materialize, including complaint mechanisms.

The deployer notifies the market surveillance authority of the results and updates the assessment when relevant elements change. The FRIA does not replace a data protection impact assessment: where a DPIA under the GDPR already covers some of these points, the FRIA complements it. A city using a high-risk system to prioritize social benefit applications is a typical case requiring both.