Skip to main content

Fundamental rights impact assessment (FRIA) under Article 27

Which deployers must carry out a FRIA before first use, what it covers, and how it relates to the GDPR DPIA.

Certain deployers of high-risk AI systems must assess the impact on fundamental rights before first use (Article 27). Covered are bodies governed by public law and private entities providing public services. Also covered are deployers of credit-scoring and life and health insurance systems (Annex III, points 5(b) and (c)). Annex III point 2 systems are excluded.

The duty applies from 2 December 2027. The deployer then notifies the market surveillance authority of the results. Article 99(4) omits Article 27, so penalties follow national rules (Article 99(1)). Next step: check whether Article 27 covers you, then start the assessment.

Three groups of deployers must carry out a FRIA

Article 27 covers high-risk systems under Article 6(2), which is the Annex III route, except Annex III point 2 (critical infrastructure). It does not cover Annex I systems. Three groups of deployers must carry out the assessment.

  • Bodies governed by public law

    Deployers that are bodies governed by public law must carry out a FRIA for every Annex III high-risk system they deploy, except point 2.

  • Private entities providing public services

    Private entities providing public services must carry out a FRIA for the same systems.

  • Credit scoring and insurance deployers

    Any deployer of a system that evaluates the creditworthiness of natural persons or establishes their credit score (Annex III, point 5(b)), or that is used for risk assessment and pricing in life and health insurance (point 5(c)), must carry out a FRIA. Systems used only to detect financial fraud are not covered by point 5(b).

The FRIA covers six elements, then you notify the authority

  1. 1

    1. Your processes

    Describe the processes in which you will use the system, in line with its intended purpose (Article 27(1), point (a)).

  2. 2

    2. Period and frequency of use

    Describe the period of time within which, and the frequency with which, each system is intended to be used (point (b)).

  3. 3

    3. Affected persons

    Identify the categories of natural persons and groups likely to be affected by the use in the specific context (point (c)).

  4. 4

    4. Specific risks of harm

    Identify the specific risks of harm to those categories, taking into account the information the provider gives under Article 13 (point (d)).

  5. 5

    5. Human oversight

    Describe how human oversight is put in place, according to the instructions for use (point (e)).

  6. 6

    6. Measures if risks materialise

    Set out the measures to take if the risks materialise, including internal governance arrangements and complaint mechanisms (point (f)).

  7. 7

    7. Notify the authority

    Notify the market surveillance authority of the results and submit the filled-out template (Article 27(3)). Deployers may be exempt from this notification in the case of Article 46(1).

The FRIA can be reused, updated and linked to a DPIA

  • Reuse and updates

    The duty applies to the first use of the system. In similar cases the deployer may rely on previously conducted FRIAs or on existing impact assessments carried out by the provider. If an element changes or is no longer up to date during use, the deployer must take the necessary steps to update it (Article 27(2)).

  • Link to the data protection impact assessment

    If a duty of Article 27 is already met by a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the FRIA may cross-refer to it or include relevant parts of it (Article 27(4), as amended by Regulation (EU) 2026/1744). The AI Office develops a template questionnaire, including an automated tool, to help deployers comply (Article 27(5)).

  • Public authorities also register the findings

    Deployers that are public authorities register their use of the system in the EU database, including a summary of the FRIA findings (Article 49(3) and Annex VIII, Section C, point 4). For Annex III points 1, 6 and 7 in the areas of law enforcement, migration, asylum and border control management, the entry sits in a secure non-public section and leaves out that summary (Article 49(4)).

How Scanara supports your FRIA

Scanara does not decide whether Article 27 covers you, and it does not notify the authority. Both stay with you.

Guided FRIA assessment

Questions follow the six elements of Article 27(1). Scanara drafts the FRIA report from your answers and creates a new version when an element changes (Article 27(2)).

Link to a DPIA

You can link an approved DPIA of the same system to the FRIA. The FRIA can then cross-refer to it (Article 27(4)).

Notification document

Scanara exports a document for the notification to the market surveillance authority (Article 27(3)). You send it yourself.

Open the Scanara demo

Read more on the surrounding rules

Common questions about the FRIA

Does a GDPR data protection impact assessment replace the FRIA?

No. A data protection impact assessment can supply parts of the FRIA, because Article 27(4) lets the deployer cross-refer to it or include relevant parts, but only for obligations of Article 27 that it already meets. The FRIA still has to cover each element of Article 27(1).

How often must a FRIA be updated?

Article 27 sets no fixed cycle. The duty applies to the first use of a system, and the deployer must update the FRIA if it considers that an element has changed or is no longer up to date (Article 27(2)).

What happens if a deployer skips the FRIA?

Skipping a mandatory FRIA infringes the Regulation. Article 99(4) lists the obligations of deployers under Article 26 but not Article 27. Member States lay down the penalty rules for any infringement of the Regulation (Article 99(1)), so check the national rules of your Member State. Where the AI Office is competent under Article 75(1), it can impose fines as referred to in Article 99(4) for the infringement of any applicable provision, including those not listed there (Article 75c(4)(a)).

Is the FRIA published?

The deployer must notify the results to the market surveillance authority (Article 27(3)). Deployers that are public authorities also register a summary of the findings in the EU database (Article 49(3), Annex VIII Section C point 4). The Regulation does not require other deployers to publish their FRIA.

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.