Comparison
FRIA vs DPIA
Written with AI from the sources below and checked against our facts sheet. Last checked . How this site is made · Spot an error?
Part of: EU AI Act
The one-line rule
A DPIA is the GDPR controller's check on high-risk personal data processing. A FRIA is certain deployers' check on a high-risk AI system's impact on fundamental rights. They can share content but remain separate duties.
Side by side
| FRIA | DPIA | |
|---|---|---|
| Legal basis | EU AI Act Art. 27 | GDPR Art. 35 |
| Who does it | Certain deployers of high-risk AI systems | The controller of the processing |
| Trigger | Deploying an Annex III high-risk system as a public body or a private provider of public services, or for credit scoring or life and health insurance pricing | Processing likely to result in a high risk to people's rights and freedoms |
| Technology covered | High-risk AI systems only | Any processing of personal data, AI or not |
| Focus | All fundamental rights of the people affected by the system's use | Risks to individuals from processing their personal data |
| Required contents | Processes, duration and frequency of use, affected groups, specific risks of harm, human oversight, and measures if risks materialize | Description and purposes, necessity and proportionality, risks to individuals, and measures to address them |
| Timing | Before first use; updated when its elements change | Before processing starts; reviewed when the risk changes |
| Regulator involvement | Results notified to the market surveillance authority, using the AI Office template | Supervisory authority consulted only if high risk remains after mitigation (Art. 36) |
| Applies from | 2 December 2027 for Annex III systems, as amended | 25 May 2018 |
When each applies
A DPIA starts from personal data. The controller must assess before processing that is likely to be high risk. Art. 35(3) names three cases that always need one:
- systematic, extensive automated evaluation, including profiling, with legal or similarly significant effects;
- large-scale processing of special category or criminal-offense data;
- large-scale systematic monitoring of publicly accessible areas.
Many AI projects hit the first case. A private employer using a high-risk hiring tool, for example, likely needs a DPIA but not a FRIA.
A FRIA starts from the deployer and the use. Art. 27(1) covers deployers of Annex III high-risk systems in three groups:
- bodies governed by public law;
- private entities providing public services, such as education, health care or housing;
- deployers using AI for credit scoring (Annex III point 5(b)) or life and health insurance pricing (point 5(c)).
Critical-infrastructure systems in Annex III point 2 are excluded. A deployer may rely on an earlier FRIA, or the provider's assessment, for similar cases (Art. 27(2)).
Both apply when a covered deployer processes personal data with the system, which is common. Art. 26(9) tells deployers to use the provider's instructions and information when doing their DPIA. The Digital Omnibus rewrote Art. 27(4). Where a DPIA already meets a FRIA obligation, the deployer may cross-reference or include the relevant parts. The AI Office's FRIA template must support that reuse (Art. 27(5)).
Worked example
Corvane Mutual, a fictional Portuguese insurer, plans to use a vendor's AI model to price individual health policies. The model uses medical history, past claims and lifestyle data.
As controller, Corvane needs a DPIA before processing starts. The project involves health data at large scale and profiling with significant effects, two Art. 35(3) cases. The DPIA covers the lawful basis for health data, data minimization, retention, security and vendor access.
Corvane is also a deployer of a high-risk system for health insurance pricing. It needs a FRIA before first use once the Annex III rules apply on 2 December 2027. The FRIA asks wider questions. Could older customers or people with chronic conditions be priced out of cover? Who can override a quote? How do customers complain, and what happens if the model treats a group unfairly?
Corvane builds the FRIA by cross-referencing the DPIA's description of the processing and its data protection risks. It then adds the rights analysis, the oversight design and the complaint route. It notifies the market surveillance authority of the results. The DPIA goes to the data protection supervisory authority only if high residual risk remains.
The exam trap
The classic trap is treating one assessment as a substitute for the other. "We already did a DPIA, so no FRIA is needed" is wrong. So is "every deployer of high-risk AI must do a FRIA."
The tells:
- Personal data and a controller point to a DPIA.
- A high-risk AI system plus a public body, public-service provider, credit scorer or life or health insurer points to a FRIA.
- FRIA results go to the market surveillance authority. A DPIA reaches the data protection supervisory authority only through prior consultation.
- The FRIA is a deployer duty. The provider's counterpart is the conformity assessment (see provider vs deployer).
Since the Omnibus, an answer saying a FRIA may reuse DPIA content is correct. An answer saying the DPIA replaces the FRIA is not. Drill the triggers in lesson II.C.6 and the DPIA steps in lesson II.A.3.
Frequently asked questions
Does a DPIA replace a FRIA under the EU AI Act?
No. They answer different questions and have different owners. Since the 2026 Digital Omnibus, Art. 27(4) lets a deployer reuse an existing DPIA. Where the DPIA already meets a FRIA obligation, the deployer can cross-reference or include the relevant parts. It must still cover the other FRIA elements, such as affected groups, human oversight and complaints. It must also notify the market surveillance authority of the results.
Who needs to do a FRIA?
Three groups of deployers of Annex III high-risk AI systems must do one. They are bodies governed by public law, private entities providing public services, and deployers that score credit or price life and health insurance. Critical-infrastructure systems (Annex III point 2) are excluded. Providers never do a FRIA; their pre-market check is the conformity assessment.
When is a DPIA required for an AI system?
Whenever processing personal data is likely to result in a high risk to people's rights and freedoms (GDPR Art. 35(1)). Art. 35(3) always requires one in three cases. They are extensive profiling with legal or similarly significant effects, large-scale special category or criminal-offense data, and large-scale monitoring of public areas. Many AI uses, such as credit scoring, hiring and health analytics, meet at least one of these.
When does the FRIA requirement start?
The FRIA sits with the other high-risk obligations in Chapter III of the AI Act. After the Digital Omnibus (Regulation (EU) 2026/1744), those apply to Annex III systems from 2 December 2027. From then, covered deployers must complete a FRIA before first use. The DPIA duty has applied since the GDPR took effect on 25 May 2018.