What is a fundamental rights impact assessment?

Article 27 applies to deployers of high-risk AI systems listed in Annex III, except systems for critical infrastructure, when the deployer is:

• a body governed by public law, or a private entity providing public services, or
• a deployer of a system that evaluates creditworthiness or sets a credit score (fraud detection excepted), or that assesses risk and sets prices for life and health insurance.

Providers do not run a FRIA. Their own duties sit in the provider obligations of the Act.

• The deployer’s processes in which the system will be used, in line with its intended purpose.
• The period and frequency of use.
• The categories of people and groups likely to be affected in that context.
• The specific risks of harm to them, using the information the provider supplies.
• The human oversight measures, following the instructions for use.
• The measures to take if the risks materialise, including internal governance and complaint arrangements.

The deployer notifies the market surveillance authority of the results, using a template from the AI Office, and updates the assessment when any of these elements changes.

The FRIA is part of the high-risk obligations. After Regulation (EU) 2026/1744, those apply to standalone Annex III systems from 2 December 2027. Where a data protection impact assessment under Article 35 of the GDPR already meets some of these duties, the FRIA complements it rather than repeating it. Many deployers run both on the same system record. See when a DPIA is required.

In AI Governance in Acuna GRC, each AI system has its own impact assessment. Screening first records whether a full assessment is owed. The five-part wizard covers purpose and context, affected parties and harms, oversight and contestation, measures and residual risk, and review. Tick Fundamental-rights impact assessment and one extra section appears, so one record answers both. Approval freezes it, and linking the system to its processing activities in Data Privacy keeps the DPIA on the same record. See AI Governance in Acuna GRC.