Fundamental Rights Impact Assessment: [High-risk AI system] at [Deployer]
Fundamental rights impact assessment (FRIA) for a deployer of a
high-risk AI system, organised on Article 27 of the EU Artificial
Intelligence Act (Regulation (EU) 2024/1689 as amended by Regulation
(EU) 2026/1744, the Digital Omnibus on AI). It records the deployer's
processes, the period and frequency of use, the people affected, the
specific risks of harm, human oversight, the measures if risks
materialise, the notification to the market surveillance authority and
the link to the DPIA. Replace every [bracketed] value and every row
marked Example. Under the amended Article 113, the high-risk
obligations in Chapter III Sections 1 to 3, which include Article 27,
apply from 2 December 2027 for Article 6(2) (Annex III) systems, the
only systems Article 27 covers (2 August 2028 for Annex I systems);
check the consolidated text. This is a
documentation format, not legal advice.
Document control
| Field | Value |
|---|
| Document ID | [FRIA-001] |
| Deployer | [Legal name, address] |
| Deployer category | [Body governed by public law / Private entity providing public services / Deployer of an Annex III point 5(b) or 5(c) system] |
| High-risk AI system | [Name, version] |
| Provider | [Provider name, contact] |
| EU database registration (if applicable) | [Reference] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Notified / Superseded] |
| Owner | [@fria-owner] |
| Assessment team | [@legal], [@dpo], [@business-owner], [@it-lead], [@equality-officer] |
| Last updated | YYYY-MM-DD |
| Date of first use | YYYY-MM-DD |
Approvals
| Role | Name | Decision | Date |
|---|
| Business process owner | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| Data protection officer | [@name] | [Opinion] | YYYY-MM-DD |
| Legal counsel | [@name] | [Decision] | YYYY-MM-DD |
| Senior accountable officer | [@name] | [Decision] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change summary |
|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | Example: Approved and notified to the market surveillance authority |
| 1.1 | YYYY-MM-DD | [@name] | Example: Updated after extending use to a second district (element (b) and (c) changed) |
Contents
1. Applicability and scope
1.1 System classification
| Question | Answer | Evidence |
|---|
| Is the system high-risk under Article 6(2) (an Annex III use case)? | [Yes / No] | Example: Annex III point 5(a): eligibility for essential public assistance benefits; provider's declaration of conformity |
| Is it in Annex III point 2 (critical infrastructure)? | [Yes / No] | Article 27 does not apply to point 2 systems |
| Is the system used in line with the provider's intended purpose? | [Yes / No] | Instructions for use, section [x] |
1.2 Deployer applicability
| Condition | Applies? |
|---|
| Deployer is a body governed by public law | [Yes / No] |
| Deployer is a private entity providing public services | [Yes / No] |
| System is an Annex III point 5(b) system (creditworthiness or credit scoring of natural persons, other than fraud detection) | [Yes / No] |
| System is an Annex III point 5(c) system (risk assessment and pricing for life and health insurance) | [Yes / No] |
Conclusion: [Example: Article 27 applies. The deployer is a municipality
(body governed by public law) using an Annex III point 5(a) system.]
1.3 Reliance on earlier assessments
[State whether a previous FRIA or an impact assessment by the provider is
relied on for similar cases, and which parts.] Example: No prior FRIA
exists. The provider's fundamental rights considerations in its
instructions for use (section 7) are used as input to section 3.4.
2. Information from the provider
| Item from instructions for use | Summary | Gap or question to provider |
|---|
| Intended purpose | Example: Flags applications for manual verification | None |
| Accuracy and known limitations | Example: Precision 0.71 for "high-risk" flag; lower for applicants under 25 | Request subgroup data by nationality |
| Foreseeable risks to fundamental rights | Example: False flags delay benefits | None |
| Human oversight measures | Example: Flags must be reviewed by trained staff; no automatic refusal | None |
| Input data specifications | Example: Application form fields 1 to 42 | Clarify handling of missing income data |
| Logging | Example: Logs retained 6 months by provider | Deployer retention to be aligned |
3. Assessment elements (Article 27(1))
3.1 (a) Description of the deployer's processes using the system
[Describe the business process, where the system sits in it, and the
decisions it informs, in line with its intended purpose.]
Example: The Social Services department processes about 14,000
applications per year for housing assistance. After an application is
submitted, the system scores it for the likelihood of incomplete or
inconsistent information. Applications scored above 0.6 are routed to a
verification team; all others go to standard processing. The system does
not approve or refuse applications.
3.2 (b) Period and frequency of use
| Item | Value |
|---|
| Start date | Example: YYYY-MM-DD |
| Intended period | Example: 24 months, then review |
| Frequency | Example: Every new application; about 55 per working day |
| Operating hours | Example: Batch every hour, 07:00 to 19:00 |
3.3 (c) Categories of natural persons and groups likely to be affected
| ID | Category | Estimated number per year | Vulnerability factors |
|---|
| AP-01 | Example: Applicants for housing assistance | 14,000 | Low income, possible disability, limited language skills |
| AP-02 | Example: Household members including children | 22,000 | Children; dependants |
| AP-03 | Example: Applicants with recent migration history | 2,500 | Non-standard documentation |
| AP-04 | Example: Case officers and verification staff | 60 | Workload; reliance on tool |
3.4 (d) Specific risks of harm to those persons or groups
| ID | Risk of harm | Groups | Rights concerned | Severity (1 to 5) | Likelihood (1 to 5) | Rating |
|---|
| FR-01 | Example: Higher false flag rate for applicants with foreign documents, delaying support | AP-03, AP-02 | Non-discrimination; social security and social assistance | 4 | 3 | 12 |
| FR-02 | Example: Applicants not told that a system was used and cannot contest it | AP-01 | Good administration; effective remedy | 3 | 3 | 9 |
| FR-03 | Example: Excessive data use beyond what the process needs | AP-01, AP-02 | Private life; protection of personal data | 3 | 2 | 6 |
| FR-04 | Example: Delays affecting children's housing stability | AP-02 | Rights of the child | 4 | 2 | 8 |
| FR-05 | Example: Staff treat flags as findings of fraud | AP-01 | Presumption of good faith; dignity | 3 | 3 | 9 |
Ratings are severity times likelihood: 1 to 4 low, 5 to 9 medium, 10 to
15 high, 16 to 25 very high.
3.5 (e) Human oversight measures
[Describe the oversight measures implemented according to the provider's
instructions for use.]
| Measure | Who | Competence and authority | Evidence |
|---|
| Example: Every flagged application reviewed by a verification officer before any request to the applicant | Verification team | 1-day training on the system's limitations; authority to dismiss flags | Training records |
| Example: Flag shown with top contributing factors, never as "fraud" | Interface | n/a | Screen design |
| Example: Weekly sample of 50 non-flagged applications reviewed | Team lead | Authority to suspend the system | Sample log |
| Example: Monthly monitoring of flag rate by group | Data analyst | Reports to steering group | Dashboard |
| Example: Ability to stop use and revert to manual triage | Head of service | Documented in runbook | Runbook |
3.6 (f) Measures if the risks materialise
| Risk | Detection | Response | Owner |
|---|
| FR-01 | Flag rate for AP-03 more than 1.25 times overall rate for two months | Raise threshold for affected group pending provider fix; inform provider; review affected cases | Head of service |
| FR-02 | Complaints or audit finding | Correct notices; reopen affected decisions on request | Legal |
| FR-05 | Sample shows flags treated as fraud findings | Retraining; disciplinary process if needed | Team lead |
| Any serious incident | Staff report, complaint, monitoring | Stop use if needed; inform provider and authorities as required by the Regulation (Article 26) | Senior accountable officer |
Governance arrangements: [Example: a steering group (head of service,
DPO, legal, equality officer) meets monthly for the first six months, then
quarterly, and can suspend use.]
Complaint mechanisms: [Example: applicants can complain online, by phone
or in person; complaints mentioning the system are tagged and reviewed
within 10 working days; the normal administrative appeal remains
available; applicants are informed of their right to an explanation of
individual decisions under Article 86 where it applies.]
4. Rights-by-rights analysis
| Right (EU Charter) | Relevant? | Linked risks | Comment |
|---|
| Human dignity | [Yes / No] | FR-05 | |
| Respect for private and family life | [Yes / No] | FR-03 | |
| Protection of personal data | [Yes / No] | FR-03 | See DPIA |
| Non-discrimination | [Yes / No] | FR-01 | |
| Rights of the child | [Yes / No] | FR-04 | |
| Integration of persons with disabilities | [Yes / No] | | |
| Social security and social assistance | [Yes / No] | FR-01 | |
| Right to good administration | [Yes / No] | FR-02 | |
| Right to an effective remedy | [Yes / No] | FR-02 | |
| Freedom of expression and information | [Yes / No] | | Usually not relevant for this use |
5. Relationship to the DPIA
| Item | Value |
|---|
| DPIA reference | [DPIA-ID, version, date] |
| Sections reused | Example: Description of processing (DPIA 2), necessity and proportionality (DPIA 4), data security measures (DPIA 7) |
| What this FRIA adds | Example: Non-discrimination analysis, rights of the child, good administration, complaint handling |
| DPO opinion | [Summary] |
6. Notification to the market surveillance authority
| Item | Value |
|---|
| Market surveillance authority | [Name, Member State] |
| Template used | [AI Office questionnaire template, version / not yet available] |
| Date submitted | YYYY-MM-DD |
| Reference number | [Reference] |
| Exemption claimed (Article 46(1)) | [No / Yes, with justification] |
| Submitted by | [@name] |
| Confirmation received | [Yes / No], YYYY-MM-DD |
7. Review and update
| Trigger | Elements affected | Action |
|---|
| New system version from provider | (d), (e) | Review provider information; update risks |
| Change in process or user group | (a), (c) | Update and re-notify if results change |
| Extension of period or frequency | (b) | Update |
| Monitoring threshold breached | (d), (f) | Reassess; consider suspension |
| Annual review | All | Confirm or update |
8. Conclusion
| Item | Value |
|---|
| Overall assessment | [Example: Use may proceed; two risks rated medium-high after measures] |
| Conditions | Example: Group monitoring for FR-01 live before first use; notice wording approved by legal |
| Residual concerns | [Summary] |
| Decision | [@senior-accountable-officer], YYYY-MM-DD |
9. Glossary and references
| Term | Meaning |
|---|
| Deployer | A person or body using an AI system under its authority in a professional activity |
| Provider | The organisation that develops the AI system and places it on the market under its name |
| FRIA | Fundamental rights impact assessment under Article 27 of the AI Act |
| DPIA | Data protection impact assessment under Article 35 GDPR |
| Market surveillance authority | National authority that supervises AI systems on the market |
References: Regulation (EU) 2024/1689 as amended by Regulation (EU)
2026/1744 (consolidated text), Articles 6, 13, 26, 27, 46, 86, 113 and
Annex III; Charter of Fundamental Rights of the European Union;
Regulation (EU) 2016/679 (GDPR), Article 35; [provider's instructions
for use]; [DPIA].
Standard and licence note
Based on Regulation (EU) 2024/1689 (the Artificial Intelligence Act) as
amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI),
Article 27 on the fundamental rights impact assessment for high-risk AI
systems, as published in the Official Journal of the European Union; EU
legislative texts are free to reuse. The required elements are
summarised in original wording and no text of the Regulation is
reproduced. Check the consolidated text on EUR-Lex for the binding
wording, any later amendments and the AI Office template; under the
amended Article 113 the obligation applies from 2 December 2027 for the
Article 6(2) (Annex III) systems it covers. This is a
documentation format, not legal advice. Template licence: MIT.