Fundamental rights impact assessment (FRIA)

Article 27 requires some deployers to assess, before first using a high-risk system, its impact on fundamental rights. It applies to public bodies, private entities providing public services, and those using AI to assess creditworthiness or price life and health insurance.

The assessment describes: in which processes and for how long the system will be used; which people or groups may be affected; the specific risks of harm; human oversight measures; and what will be done if the risks materialise, including complaint mechanisms. The results are notified to the market surveillance authority.

It is not the same as the GDPR DPIA, but they complement each other: if you already have a DPIA for the same processing, you can reuse much of the work.