Skip to main content
Praxikon
Free check
Article 27 of 11324%
Nederlands

Article 27: Fundamental rights impact assessment for high-risk AI systems

Article 27 introduces the FRIA: an assessment of fundamental-rights impact before certain high-risk AI systems are deployed.

, AI and privacy legal adviserobligations checked against the source on
Check your own case for free

Praxikon tracks Article 27 (Fundamental rights impact assessment for high-risk AI systems) under the EU AI Act, citing the source for every statement.

EU Official:
UpcomingFRIA duty for applicable Annex III systems from 2 Dec 2027
Title III: High-Risk AI Systems

Application dates

  • : FRIA duty for applicable high-risk systems under Article 6(2) and Annex III

Official text

||

Source: EUR-Lex, Regulation (EU) 2024/1689. Text reproduced verbatim.

Download AI Act (PDF) →

Decision tree

Do you need to carry out a FRIA?

A FRIA (fundamental rights impact assessment) is not mandatory for every deployer of a high-risk system. The obligation applies from 2 December 2027, before first use.

Question 1 · Art. 27(1) · Art. 6(2)

Are you, as deployer, going to deploy a high-risk AI system from Annex III (Article 6(2))?

High-risk systems via Annex I (safety components of products) do not fall under Article 27.

Full diagram
  1. 1

    Are you, as deployer, going to deploy a high-risk AI system from Annex III (Article 6(2))?

    Art. 27(1) · Art. 6(2)

    • Yes → Question 2
    • No → Outcome A
  2. 2

    Is the system intended as a safety component in the management or operation of critical digital infrastructure, road traffic or the supply of water, gas, heating or electricity (Annex III point 2)?

    Art. 27(1) · bijlage III punt 2

    • Yes → Outcome B
    • No → Question 3
  3. 3

    Are you a body governed by public law, such as a ministry, municipality, province or water authority, or another organisation governed by public law?

    Art. 27(1)

    • Yes → Question 7
    • No → Question 4
  4. 4

    Are you a private entity providing public services, for example in education, healthcare, social services, housing or the administration of justice?

    Art. 27(1) · overweging 96

    • Yes → Question 7
    • No → Question 5
  5. 5

    Is the system intended to evaluate the creditworthiness of natural persons or establish their credit score, and not only to detect financial fraud?

    Art. 27(1) · bijlage III punt 5 onder b

    • Yes → Question 7
    • No → Question 6
  6. 6

    Is the system intended for risk assessment and pricing in relation to natural persons in the case of life and health insurance?

    Art. 27(1) · bijlage III punt 5 onder c

    • Yes → Question 7
    • No → Outcome C
  7. 7

    Have you already carried out a DPIA for this use under Article 35 GDPR?

    Art. 27(4)

    • Yes → Outcome E
    • No → Outcome D

Outcome A · Does not apply

No FRIA obligation under Article 27

Article 27 only applies to deployers of high-risk systems from Annex III. If the system processes personal data, do check whether a DPIA is needed (Article 35 GDPR).

Art. 27(1) · art. 35 AVG

Outcome B · Does not apply

Critical infrastructure is excluded

There is no FRIA obligation for high-risk systems in Annex III point 2, not even for public bodies. The obligations of Article 26 still apply. The provider registers these systems at national level instead of in the EU database (Article 49(5)).

Art. 27(1) · bijlage III punt 2 · art. 26 · Art. 49(5)

Outcome C · Does not apply

No FRIA required, but the Article 26 obligations apply

As a private deployer outside the listed cases you need not carry out a FRIA. The obligations of Article 26 do apply. A voluntary fundamental rights check can help with human oversight and with a DPIA.

Art. 27(1) · art. 26

Outcome D · Applies

You must carry out a FRIA before first use

Describe your processes in which the system is used, the period and frequency, the groups affected, the specific risks of harm, the human oversight according to the instructions for use, and the measures if risks materialise, including governance and complaint mechanisms. Notify the results to the market surveillance authority with the filled-out template. In similar cases you may rely on a previous FRIA or an existing impact assessment by the provider; update the assessment when something changes (paragraph 2). For systems placed on the market or put into service before 2 December 2027, Article 111(2) applies: the regulation then only applies after a significant change in design, but for systems intended to be used by public authorities by 2 August 2030 at the latest.

Art. 27(1)(a) to f · Art. 27(2) · Art. 27(3) · Art. 27(5) · Art. 111(2)

Outcome E · Applies

You must carry out a FRIA and can build on your DPIA

Where part of the obligations is already met through the DPIA, you can cross-refer in the FRIA to the relevant sections of the DPIA or include those parts. The FRIA remains broader: it covers all fundamental rights, not only data protection. Notify the results to the market surveillance authority.

Art. 27(4) · Art. 27(1) · Art. 27(3) · art. 35 AVG

A decision tree simplifies. If you are unsure at a question, read the provision or have it assessed. Checked against the legal text on 1 October 2026.

Official guidance on this article

6

What does this mean for you?

Provider+
The FRIA is a duty for certain deployers, but providers must supply under Article 13 the information needed to assess risks, oversight measures and context of use. An existing provider impact assessment may be used as input in similar cases, but it does not transfer the deployer's responsibility.
Deployer+
Before first use, conduct a FRIA if you are a body governed by public law, a private entity providing a public service, or deploy a high-risk system under Annex III point 5(b) or 5(c) for creditworthiness or life and health insurance. Describe the process, duration and frequency of use, affected groups, specific fundamental-rights risks, human oversight and measures if risks materialise.
SME / Startup+
A private SME deployer is not inside or outside Article 27 merely because of its size. Its function and use case are decisive. An SME that provides a public service or deploys an application under Annex III point 5(b) or 5(c) may therefore be required to conduct a FRIA.
Public Sector+
A body governed by public law deploying a high-risk system under Article 6(2) must in principle conduct a FRIA before first use, except for Annex III point 2. Notify the market surveillance authority using the official template and update the assessment when relevant elements change. Regulation (EU) 2026/1744 expressly permits cross-references to, or inclusion of relevant parts from, a DPIA.

Related tools

FRIA Generator

Related Recitals

96

Related enforcement

No enforcement actions for this article yet. Follow developments via the Enforcement Tracker.

Related blog posts

Cross-references

Articles

Art. 6Art. 26

Recitals

9697

Annexes

Annex 3

Frequently asked questions

What is a FRIA and when is it mandatory?+
A FRIA assesses fundamental rights impacts before first use of an applicable high-risk system under Article 6(2). The duty covers bodies governed by public law, private entities providing public services and deployers under Annex III points 5(b) and 5(c). Point 2 is excluded.
What should a FRIA contain?+
A FRIA must describe the intended use, affected persons, specific risks to fundamental rights, mitigating measures, and oversight mechanisms.
What documentation does Article 27 of the AI Act require?+
Article 27 of the AI Act requires that relevant documentation is maintained as part of the compliance process. This may include technical documentation, instructions for use, logs or declarations of conformity, depending on the classification of the AI system.
What is the difference between a FRIA and a DPIA?+
A FRIA assesses broader fundamental rights impacts; a DPIA concerns data protection. Regulation (EU) 2026/1744 allows the FRIA to include or cross-refer to relevant DPIA parts for duties already met through it. Each applicable assessment remains required under its own conditions.
Who must carry out a FRIA?+
Bodies governed by public law, private entities providing public services, and deployers of systems for creditworthiness or credit scoring under Annex III point 5(b) and risk assessment and pricing in life and health insurance under point 5(c).
Is there a standard template available for the FRIA?+
Article 27(5) requires the AI Office to develop a simplified questionnaire template. Since Regulation (EU) 2026/1744, that template must, where relevant, support cross-references to or parts of a DPIA.
Do I need to report the FRIA results to a supervisory authority?+
Yes, Article 27(3) requires deployers to notify the market surveillance authority of the FRIA results by submitting the filled-out template. Additionally, a summary must be registered in the EU database as per Annex VIII, Section C.

What Article 27 requires in practice

Connections

What connects to Article 27 AI Act

Themes where this returns

Where this meets the other law

The counterpart in the other law

GDPR interpretation that also applies here