A fundamental rights impact assessment (FRIA) is the document in which the deployer of a high-risk AI system describes how it is used, who is affected, the risks of harm to their rights, human oversight and the measures if those risks materialise. Art. 27 of the EU AI Act requires it from public bodies, private entities providing public services and deployers using AI for credit or for life and health insurance.
How to use
- Enter the system, the deployer and the intended purpose, or import them from the DPIA template or the risk classifier.
- Answer the screening: is the system high-risk, and is the deployer within the scope of Art. 27?
- Describe the processes, the period and frequency of use and the people and groups affected, including vulnerable ones.
- List the risks per fundamental right with likelihood, severity and the measure that reduces each one.
- Record human oversight, governance and the complaint mechanism, then export the draft as DOCX and the table as CSV.
What each field asks for
| Field | What to enter |
|---|---|
| AI system name | How the system is known in the organisation. |
| Deployer | The organisation that uses the system under its authority. |
| Intended purpose | What the system does, according to the provider’s instructions for use. |
| Is the system high-risk under the EU AI Act? | Use your own classification or the result of the EU AI Act risk classifier. |
| Deployer profile | Tick what applies. With none ticked, Art. 27 does not require a FRIA. |
| a) Processes in which the system is used | How the system fits into the workflow, who uses its output and what is decided. |
| b) Period of use | From when and for how long the system will be used. |
| b) Frequency of use | Choose |
| c) People and groups affected | Categories of natural persons and groups the use may affect. One per line. |
| c) Vulnerable groups among those affected | Tick the groups that need specific care. |
| Specific measures for vulnerable groups | What changes in the process to protect these groups. |
| Right affected | |
| Possible harm and group affected | E.g. higher refusal rate for some age groups |
| Likelihood | |
| Severity | |
| Measure | E.g. bias testing by group every quarter |
| e) Human oversight owner | The role accountable for oversight, not the person’s name. |
| e) Human oversight measures | How people monitor and correct the system, in line with the instructions for use. |
| f) Measures if the risks materialise | Internal governance: who decides, how to suspend the system, how to correct and communicate. |
| f) Is there a complaint mechanism for affected people? | Choose |
| Is there a DPIA for this use? | The FRIA may reuse or incorporate the DPIA. |
| Next review date | E.g. 30 April 2027 |
Example
A fictional retailer uses a system bought from a provider to score instalment credit applications, an Annex III high-risk use with a credit profile, so a FRIA is required. Of the four risks listed, discrimination has a high inherent level and drops to medium with quarterly bias testing; privacy drops to low; access to services stays medium because severity is high; effective remedy, with no measure, stays medium and triggers a warning. Overall residual risk is medium, all six elements of Art. 27(1) are filled in and the next steps include setting the missing measure and notifying the authority of the results.
When to use
- Before a public body or a public service provider first uses a high-risk system.
- When a bank, a retailer or an insurer starts using AI for credit or for life and health insurance.
- When a DPIA for an AI system exists but rights beyond data protection are not yet covered.
- When the use changes: a new purpose, a new group of affected people or a new version of the system.
Frequently asked questions
Who needs to carry out a FRIA?
Under Art. 27 of the EU AI Act, deployers of Annex III high-risk systems that are bodies governed by public law or private entities providing public services. It also covers deployers using the system to assess the creditworthiness of individuals or to price life and health insurance. Systems used only in critical infrastructure are excluded.
What is the difference between a FRIA and a DPIA?
A DPIA assesses the risks of processing personal data. A FRIA looks at every fundamental right the use of the system may affect, such as non-discrimination, access to services and effective remedy, and covers human oversight and complaints. Under the EU AI Act as amended by Regulation (EU) 2026/1744, the FRIA may reuse or incorporate the DPIA.
How does the tool rate the risk to each right?
The inherent level is likelihood multiplied by severity, each from 1 to 3. With a measure recorded, the residual level drops one step, but high severity never drops below medium. The overall residual is the highest residual and rises one step if there is no human oversight owner or no complaint mechanism.
Do I need to notify an authority of the FRIA?
Art. 27 asks the deployer to notify the market surveillance authority of the results, and the AI Office provides a template questionnaire for this. Check the official text for the current procedure.
What if a FRIA is not required in my case?
The tool tells you when Art. 27 does not require the assessment. It may still be good practice when the system significantly affects people, and the document serves as evidence of due care.
Is the result legal advice or a guarantee of compliance?
No. It is an educational tool that produces a structured draft. It is not an audit or a certification of the organisation. Review it with legal counsel and check the EU AI Act rules currently in force, as they have been amended.
Which DPCert certification covers the FRIA?
The RAIP (Responsible AI Practitioner) assesses risk and impact assessment for AI systems, including the FRIA. The DPAI (Data Protection & AI Professional) goes deeper into privacy in AI and the link with the DPIA. A certification demonstrates what people know, not that the organisation is compliant.