Skip to main content
Audact
See the offer

Article 27 FRIA

The fundamental rights impact assessment: who owes one, and what goes in it.

Applies to deployers of listed high-risk systems

Last reviewed: 5 October 2026

Article 27 asks a different question from a data protection impact assessment. It is not about the risk to data, it is about the risk to the people the system is used on: discrimination, dignity, access to a service. Certain deployers of high-risk systems listed in Annex III — with one area of that list excepted, the critical infrastructure systems in point 2 — must produce that assessment before first use, notify the outcome to the market surveillance authority, and update it whenever the use changes.

What the law requires

Before putting a high-risk AI system referred to in Article 6(2) into use, certain deployers must perform an assessment of its impact on fundamental rights. Systems intended to be used in the area listed in point 2 of Annex III — critical infrastructure — are expressly excepted from that duty.
Regulation (EU) 2024/1689, Art. 27(1)
The assessment covers the deployer's processes the system will be used in, the period and frequency of intended use, the categories of natural persons likely to be affected, the specific risks of harm to them, the human oversight measures, and the measures to take if those risks materialise.
Regulation (EU) 2024/1689, Art. 27(1)(a)-(f)
The duty falls on bodies governed by public law and private entities providing public services, and on deployers of the two use cases in points 5(b) and 5(c) of Annex III: evaluating creditworthiness or establishing a credit score, and risk assessment and pricing in life and health insurance.
Regulation (EU) 2024/1689, Art. 27(1)
The obligation applies to the first use of the system. In similar cases the deployer may rely on a fundamental rights impact assessment already carried out, or on one carried out by the provider. If any of the assessed elements has changed or is no longer up to date, the deployer must take the steps needed to update the information.
Regulation (EU) 2024/1689, Art. 27(2)
Once performed, the deployer notifies the market surveillance authority of the results, using the questionnaire the AI Office provides.
Regulation (EU) 2024/1689, Art. 27(3) and 27(5)
Where a data protection impact assessment under the GDPR already covers part of the ground, the fundamental rights assessment complements it rather than replacing it.
Regulation (EU) 2024/1689, Art. 27(4)

What Audact does about it

The records a fundamental rights assessment has to point at (disclosures, policy verdicts, incidents, who was affected and when) are produced by every governed interaction today.
In controlled testing
A fundamental rights assessment, pre-populated from your deployment. Produced on request; generator: Planned.
Produced on request
The risk section pointing at real records rather than at intentions: the incidents that occurred, the verdicts that were reached, the disclosures that were made.
In development
Export with the checksums of the underlying records, so an authority can check that the evidence referenced is the evidence held.
In development

Not a DPIA

Two assessments, two questions, one system.

A data protection impact assessment asks what could go wrong with the personal data: unauthorised access, excessive retention, an unlawful basis. A fundamental rights impact assessment asks what could go wrong for the person: being refused a service, being ranked lower, being treated differently on a ground that should not have mattered.

The same deployment often needs both, and Article 27(4) says as much: where the data protection assessment covers ground, the fundamental rights one builds on it. What it cannot do is inherit its conclusions. A system can be flawless on data protection and still produce an outcome the fundamental rights assessment is written to catch.

Who owes one

It is the use case, not the technology, that pulls you in.

Article 27 does not reach every deployer of every AI system. It attaches to the high-risk systems of Article 6(2) — the Annex III list — and carves one area straight back out of it: systems intended to be used in the area of point 2 of that Annex, critical infrastructure, are excepted. Within what remains it reaches a defined set of deployers: bodies governed by public law, private entities providing public services, and deployers of the two use cases in points 5(b) and 5(c), credit-scoring and the pricing of life and health insurance.

For most voice deployments (booking, support, qualification, follow-up) that is not the position. Where it becomes the position is when the agent contributes to a decision about access, eligibility or price. Establish which of those two you are building before the assessment becomes urgent rather than after.

Note

Information, not legal advice.

This page sets out the rules as we read them, with the article numbers so you can check us. It is not legal advice, and your own position depends on facts this page cannot know. Take advice from qualified counsel before you rely on it.

Questions

What is a fundamental rights impact assessment?
A structured assessment a deployer performs before putting a listed high-risk AI system into use. It covers the processes the system will be used in, the period and frequency of use, the categories of people likely to be affected, the specific risks of harm to them, the human oversight arrangements, and the measures to take if the risks materialise.
Who has to carry one out?
Bodies governed by public law and private entities providing public services, plus deployers of the two use cases in points 5(b) and 5(c) of Annex III: credit-scoring, and risk assessment and pricing in life and health insurance. One area is excepted from the duty altogether by Article 27(1) itself: the critical infrastructure systems in point 2 of Annex III. The market surveillance authority is notified of the results.
Does a DPIA cover it?
It complements it, under Article 27(4), but it does not replace it. The two assessments ask different questions: one about the data, one about the person the system is used on.
How often does it need redoing?
The duty attaches to the first use, and after that whenever any of the assessed elements has changed or is no longer up to date. Article 27(2) also lets a deployer rely, in similar cases, on an assessment already carried out or on one the provider carried out, so a second comparable deployment does not by itself mean a second assessment from scratch. In practice that means treating it as a living document tied to the configuration rather than a one-off produced for a launch.

An assessment is only as good as the records under it

Proof shows what a governed interaction leaves behind, and which parts of it a third party can recompute: the material a fundamental rights assessment has to be able to point at.

See a receipt

Related