Free template · Word · English and Dutch

FRIA template: fundamental rights impact assessment under Article 27 of the EU AI Act

A FRIA (fundamental rights impact assessment) is the assessment that Article 27 of the EU AI Act requires from certain deployers of high-risk AI: bodies governed by public law, private entities providing public services, and deployers of AI for creditworthiness or for life and health insurance. They carry it out before first use, from 2 December 2027.

Last checked against the law: 6 October 2026
Editor: Zahed Ashkara, jurist, privacy and AI
Version and template ID: 2.0 · praxikon:template:fria
Legal basis: Article 27 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; Article 35 of Regulation (EU) 2016/679 (GDPR)

Who is this template for?

Public bodies and executive agencies (bodies governed by public law)A FRIA for every high-risk system in Annex III, except point 2 critical infrastructure (Article 27(1))
Private entities providing public services, such as housing associations, hospitals and private educational institutionsArticle 27(1), explained in recital 96
Banks and lendersCreditworthiness assessment and credit scoring of natural persons (Annex III, point 5(b))
Life and health insurersRisk assessment and pricing (Annex III, point 5(c))
Data protection officer or privacy officerLink with the DPIA and prior consultation (Article 27(4); Articles 35 and 36 GDPR)
Process owners and managers of reviewersHuman oversight and suspending use (Article 26(2) and (5), Article 14(4))

What is inside

Scope test per type of deployer, with a four-question decision tree (chapter 1)
Timeline from 2 December 2027 and the transitional rule in Article 111(2) (section 1.1)
Summary for management and supervisory bodies: three largest risks, three measures and approval
The six elements of Article 27(1), points (a) to (f) (chapters 2 to 5, 8 and 9)
Checklist of the information to request from the provider under Article 13(3) (chapter 5)
Table of rights in the EU Charter of Fundamental Rights and a risk register (sections 5.1 and 5.2)
Likelihood times severity scoring, with thresholds and residual risk after measures (chapter 6)
Necessity and proportionality test (chapter 7)
Link with the DPIA per element of Article 27 (chapter 10)
Notification to the market surveillance authority and how to find yours, with the Netherlands as an example (chapter 11)
Updates, reuse and version control (chapter 12)
National instruments such as the Dutch IAMA, and registration in the EU database (chapter 13)
Fictional worked example of a credit scoring system, without a pre-filled conclusion (Annex A)

How to use the template

Use chapter 1 to test whether the FRIA obligation applies to this system. If it does not, record why; a DPIA may still be required.
Ask the provider for the instructions for use and the information required by Article 13, and take your DPIA to hand.
Complete chapters 2 to 9 with a small team: process owner, data protection officer or privacy officer, a day-to-day user and, where possible, representatives of affected groups.
Score the risks before and after measures, and answer the necessity and proportionality test.
Complete the summary last, have the FRIA approved and notify the results to the market surveillance authority of your Member State.
Update the FRIA as soon as an element changes, such as a new model version, a different target group or new figures from the provider.

Common mistakes

Requiring a FRIA from every deployer of high-risk AI. Article 27 applies only to bodies governed by public law, private entities providing public services and the systems in Annex III, point 5(b) and (c). Critical infrastructure (point 2) and systems that are high-risk through Annex I fall outside it.
Leaving the FRIA to the provider. It is an obligation of the deployer and concerns the use in your organisation; the CE marking does not replace it. In similar cases you may rely on an existing assessment by the provider (Article 27(2)).
Treating the DPIA as the FRIA. The DPIA looks at personal data, the FRIA at all fundamental rights. You may refer to the DPIA (Article 27(4)), but must add what it does not cover.
Recording risks as labels, such as 'risk of discrimination'. Describe the mechanism (which data, which pattern, which group, which harm) and use the information the provider gives under Article 13.
Forgetting the notification. After the assessment the deployer notifies the market surveillance authority of the results (Article 27(3)), unless the exemption in Article 46(1) applies.

Prefer to work online? FRIA generator: complete the FRIA online

When do you need legal advice?

You are not sure whether Article 27 applies to you. You are a private party with a task in education, healthcare, housing or social services, or the system sits on the line between creditworthiness assessment (Annex III, point 5(b)) and fraud detection. Whether the deployer's FRIA obligation applies depends on that qualification.
The residual risk stays high or the provider supplies too little. After measures a risk still scores 10 or more, or the provider does not supply the information required by Article 13. The decision to deploy is then open to question, and through the DPIA you as controller may have to consult the data protection authority before the processing starts (Article 36 GDPR).
The score in effect decides about a person. A score or recommendation is in practice decisive for a loan, a benefit or an admission. Article 22 GDPR on automated decision-making may then apply (see the SCHUFA judgment, C-634/21), with the safeguards of paragraph 3, towards you as controller. In addition, an affected person has a right to explanation from you as deployer under Article 86 of the AI Act, but only to the extent that other Union law, such as the GDPR or the Consumer Credit Directive, does not already provide for it (Article 86(3)).

Frequently asked questions

Who has to carry out a FRIA?

Deployers of a high-risk system in Annex III (except point 2, critical infrastructure) that are bodies governed by public law or private entities providing public services, and deployers of systems for the creditworthiness or credit scoring of natural persons and for risk assessment and pricing in life and health insurance (Annex III, point 5(b) and (c)). The provider does not carry out a FRIA.

When does the FRIA obligation apply?

From 2 December 2027 for Annex III systems, before first use. That date follows from the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026. Systems placed on the market or put into service before 2 December 2027 are covered only if their design changes significantly afterwards; systems intended for use by public authorities must comply by 2 August 2030 (Article 111(2)).

What is the difference between a DPIA and a FRIA?

The DPIA is an obligation of the controller under Article 35 GDPR and concerns the risks of processing personal data. The FRIA is an obligation of the deployer under Article 27 of the AI Act and covers all fundamental rights, even where no personal data is involved. What the DPIA already covers, you may include or cross-reference in the FRIA (Article 27(4)).

Whom do I notify of the FRIA results?

The market surveillance authority, using the completed AI Office template (Article 27(3) and (5)). As at 6 October 2026 that template had not been published, and not every Member State had designated its authority; the Netherlands, for example, had not. For financial institutions it is in principle their financial supervisory authority (Article 74(6)).

Can I use this template outside the Netherlands?

Yes. The template follows the EU AI Act and the GDPR, which apply in every Member State. Supervision and some instruments are national, so chapters 11 and 13 ask you to check your own country. Dutch items such as the IAMA and the Algorithm Register are included as examples.

May I adapt the template and share it within my organisation?

Yes. You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, FRIA template: fundamental rights impact assessment under Article 27 of the EU AI Act, version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/fria

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597