Glossary

Fundamental rights impact assessment

Written with AI from the sources below and checked against our facts sheet. Last checked 7 Nov 2026. How this site is made · Spot an error?

Part of: EU AI Act

A fundamental rights impact assessment (FRIA) is an EU AI Act duty (Art. 27) for certain deployers of high-risk AI, completed before first use. It records how the system will be used, who it affects and the specific risks of harm to them. It also covers human oversight and the response if risks materialize.

In plain English

A provider's conformity assessment is like crash-testing a car model in a lab. A FRIA is the driver's own check before a specific journey: this road, these passengers, this weather.

The provider cannot know how a city council or a bank will use its system, who will be affected or what oversight will exist. The FRIA makes the deployer think this through and write it down before the system touches real people.

Example

Elmstead District Council, a fictional local authority, plans to use a vendor's AI system to prioritize applicants for emergency housing support. Assessing eligibility for public assistance is an Annex III use (point 5(a)), and the council is a public body, so a FRIA is required. Its FRIA covers the six required elements:

Element	What Elmstead wrote
Process	The system ranks applications weekly; caseworkers make every decision
Period and frequency	Weekly use for an initial two-year term
Affected people	Applicants, including families with children, disabled people and recent arrivals
Specific risks	Lower rankings for applicants with incomplete records or limited English
Human oversight	Trained caseworkers can override any ranking; override rates reviewed monthly
If risks materialize	Complaint route, human re-review within ten working days, criteria for suspending use

The council cross-references its existing DPIA for data protection risks. It notifies the results to the market surveillance authority. As a public authority deployer, it also registers its use in the EU database (Art. 49(3)).

Why it matters

Art. 27 of the EU AI Act sets the rules:

Who: deployers of Annex III high-risk systems that are bodies governed by public law or private entities providing public services. Deployers using systems for credit scoring (point 5(b)) or life and health insurance pricing (point 5(c)) are also covered. Critical-infrastructure systems are excluded.
What: six elements, (a) to (f), as in the example above. Risks are identified using the provider's Art. 13 information.
When: before first use. Deployers may rely on earlier FRIAs or the provider's assessments for similar cases, and must update the FRIA when elements change (Art. 27(2)).
Notify: results go to the market surveillance authority using a template from the AI Office (Art. 27(3) and (5)).
DPIA overlap: the Digital Omnibus amended Art. 27(4). Where a GDPR DPIA already meets an obligation, the deployer can cross-reference the relevant sections.
Date: Art. 27 sits in the high-risk chapter, which the Omnibus moved to 2 Dec 2027 for Annex III systems.

How the AIGP exam tests it

FRIA questions test who owes it (lesson II.C.6) and what the deployer must assess itself (lesson IV.B.1).

Common traps:

Provider vs deployer. The FRIA is never a provider duty. The provider's counterpart is the conformity assessment.
Every deployer? No. A private manufacturer using a CV screener for its own hiring owes no FRIA. It still has Art. 26 duties, such as informing workers.
FRIA vs DPIA. DPIA is about personal data and is owed by the controller. FRIA is about all fundamental rights. One can feed the other, but neither replaces the other. See FRIA vs DPIA.
Timing. Assessing after go-live, using real complaints, is wrong.

The tell: check who the deployer is and what the system does. A public body, a public-service provider, or credit or life and health insurance use means a FRIA before first use.

Frequently asked questions

Who needs to carry out a FRIA under the EU AI Act?

Deployers of Annex III high-risk systems that are public bodies or private entities providing public services, such as education, health care or housing. Any deployer using high-risk AI for credit scoring or for life and health insurance risk assessment and pricing also needs one. Systems used in critical infrastructure (Annex III point 2) are excluded.

Is a FRIA the same as a DPIA?

No. A DPIA under GDPR Art. 35 is owed by a data controller and covers risks from processing personal data. A FRIA under AI Act Art. 27 is owed by certain deployers and covers risks to all fundamental rights from using a high-risk system. Since the 2026 Omnibus, a FRIA can cross-reference an existing DPIA instead of repeating it.

When must a FRIA be completed?

Before the deployer first uses the high-risk system, and it must be updated if any element changes or becomes outdated. Art. 27 sits with the high-risk deployer rules, which the Digital Omnibus moved to 2 Dec 2027 for Annex III systems. The results are then notified to the market surveillance authority.

Does a provider have to do a FRIA?

No. The FRIA is a deployer duty. The provider's main counterpart is the conformity assessment, which checks the system's design against the Act's requirements before it reaches the market. A provider can supply information that feeds the deployer's FRIA, but it cannot do the assessment on the deployer's behalf.

Sources

Spot an error? Tell us