# Fundamental Rights Impact Assessment: [High-risk AI system] at [Deployer]

> Fundamental rights impact assessment (FRIA) for a deployer of a
> high-risk AI system, organised on Article 27 of the EU Artificial
> Intelligence Act (Regulation (EU) 2024/1689 as amended by Regulation
> (EU) 2026/1744, the Digital Omnibus on AI). It records the deployer's
> processes, the period and frequency of use, the people affected, the
> specific risks of harm, human oversight, the measures if risks
> materialise, the notification to the market surveillance authority and
> the link to the DPIA. Replace every `[bracketed]` value and every row
> marked *Example*. Under the amended Article 113, the high-risk
> obligations in Chapter III Sections 1 to 3, which include Article 27,
> apply from 2 December 2027 for Article 6(2) (Annex III) systems, the
> only systems Article 27 covers (2 August 2028 for Annex I systems);
> check the consolidated text. This is a
> documentation format, not legal advice.

<!--
Guidance: How to use this template
- Check first that Article 27 applies (section 1.2). It applies to
  certain deployers of high-risk systems listed in Article 6(2), not to
  providers, and not to every deployer.
- Complete it before first use of the system. Article 27 lets you rely on
  a previous FRIA or the provider's assessment in similar cases, but you
  must update it when any element changes.
- Section 3 mirrors the six required elements in Article 27(1)(a) to (f).
  Keep the numbering so a reviewer can find each element.
- The AI Office is to develop a questionnaire template, which may include
  an automated tool and allows cross-references to an existing DPIA. If
  the official template is available, transfer your answers into it; this
  document is your working file and evidence.
- Read the Regulation and current Commission guidance for the binding
  wording (use the consolidated text that includes Regulation (EU)
  2026/1744) and the dates from which obligations apply; seek legal advice.
-->

## Document control

<!-- Guidance: Identify the deployer, the system and version, and the people accountable for the assessment and its notification. -->

| Field | Value |
|---|---|
| Document ID | [FRIA-001] |
| Deployer | [Legal name, address] |
| Deployer category | [Body governed by public law / Private entity providing public services / Deployer of an Annex III point 5(b) or 5(c) system] |
| High-risk AI system | [Name, version] |
| Provider | [Provider name, contact] |
| EU database registration (if applicable) | [Reference] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Notified / Superseded] |
| Owner | [@fria-owner] |
| Assessment team | [@legal], [@dpo], [@business-owner], [@it-lead], [@equality-officer] |
| Last updated | YYYY-MM-DD |
| Date of first use | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Business process owner | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| Data protection officer | [@name] | [Opinion] | YYYY-MM-DD |
| Legal counsel | [@name] | [Decision] | YYYY-MM-DD |
| Senior accountable officer | [@name] | [Decision] | YYYY-MM-DD |

## Revision history

<!-- Guidance: Article 27 requires an update when an element changes or becomes outdated. Record each update and its cause. -->

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved and notified to the market surveillance authority |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Updated after extending use to a second district (element (b) and (c) changed) |

## Contents

<!-- Guidance: Keep aligned with the headings below. -->

1. [Applicability and scope](#1-applicability-and-scope)
2. [Information from the provider](#2-information-from-the-provider)
3. [Assessment elements (Article 27(1))](#3-assessment-elements-article-271)
4. [Rights-by-rights analysis](#4-rights-by-rights-analysis)
5. [Relationship to the DPIA](#5-relationship-to-the-dpia)
6. [Notification to the market surveillance authority](#6-notification-to-the-market-surveillance-authority)
7. [Review and update](#7-review-and-update)
8. [Conclusion](#8-conclusion)
9. [Glossary and references](#9-glossary-and-references)

## 1. Applicability and scope

<!-- Guidance: Record the reasoning that Article 27 applies, so it can be checked later. If it does not apply, say why and keep this section as the record. -->

### 1.1 System classification

| Question | Answer | Evidence |
|---|---|---|
| Is the system high-risk under Article 6(2) (an Annex III use case)? | [Yes / No] | *Example:* Annex III point 5(a): eligibility for essential public assistance benefits; provider's declaration of conformity |
| Is it in Annex III point 2 (critical infrastructure)? | [Yes / No] | Article 27 does not apply to point 2 systems |
| Is the system used in line with the provider's intended purpose? | [Yes / No] | Instructions for use, section [x] |

### 1.2 Deployer applicability

| Condition | Applies? |
|---|---|
| Deployer is a body governed by public law | [Yes / No] |
| Deployer is a private entity providing public services | [Yes / No] |
| System is an Annex III point 5(b) system (creditworthiness or credit scoring of natural persons, other than fraud detection) | [Yes / No] |
| System is an Annex III point 5(c) system (risk assessment and pricing for life and health insurance) | [Yes / No] |

Conclusion: [*Example:* Article 27 applies. The deployer is a municipality
(body governed by public law) using an Annex III point 5(a) system.]

### 1.3 Reliance on earlier assessments

[State whether a previous FRIA or an impact assessment by the provider is
relied on for similar cases, and which parts.] *Example:* No prior FRIA
exists. The provider's fundamental rights considerations in its
instructions for use (section 7) are used as input to section 3.4.

## 2. Information from the provider

<!-- Guidance: Article 27 asks you to take into account the information the provider gives under Article 13 (instructions for use). Summarise what you received and any gaps. -->

| Item from instructions for use | Summary | Gap or question to provider |
|---|---|---|
| Intended purpose | *Example:* Flags applications for manual verification | None |
| Accuracy and known limitations | *Example:* Precision 0.71 for "high-risk" flag; lower for applicants under 25 | Request subgroup data by nationality |
| Foreseeable risks to fundamental rights | *Example:* False flags delay benefits | None |
| Human oversight measures | *Example:* Flags must be reviewed by trained staff; no automatic refusal | None |
| Input data specifications | *Example:* Application form fields 1 to 42 | Clarify handling of missing income data |
| Logging | *Example:* Logs retained 6 months by provider | Deployer retention to be aligned |

## 3. Assessment elements (Article 27(1))

<!-- Guidance: Each subsection matches one of the elements Article 27(1)(a) to (f) requires. Answer each in concrete terms specific to your use. -->

### 3.1 (a) Description of the deployer's processes using the system

[Describe the business process, where the system sits in it, and the
decisions it informs, in line with its intended purpose.]

*Example:* The Social Services department processes about 14,000
applications per year for housing assistance. After an application is
submitted, the system scores it for the likelihood of incomplete or
inconsistent information. Applications scored above 0.6 are routed to a
verification team; all others go to standard processing. The system does
not approve or refuse applications.

```mermaid
flowchart LR
  A["Application submitted"] --> S["AI system scores"]
  S -->|score > 0.6| V["Verification team review"]
  S -->|score <= 0.6| P["Standard processing"]
  V --> D["Case officer decision"]
  P --> D
  D --> N["Decision notice and appeal rights"]
```

### 3.2 (b) Period and frequency of use

| Item | Value |
|---|---|
| Start date | *Example:* YYYY-MM-DD |
| Intended period | *Example:* 24 months, then review |
| Frequency | *Example:* Every new application; about 55 per working day |
| Operating hours | *Example:* Batch every hour, 07:00 to 19:00 |

### 3.3 (c) Categories of natural persons and groups likely to be affected

| ID | Category | Estimated number per year | Vulnerability factors |
|---|---|---|---|
| AP-01 | *Example:* Applicants for housing assistance | 14,000 | Low income, possible disability, limited language skills |
| AP-02 | *Example:* Household members including children | 22,000 | Children; dependants |
| AP-03 | *Example:* Applicants with recent migration history | 2,500 | Non-standard documentation |
| AP-04 | *Example:* Case officers and verification staff | 60 | Workload; reliance on tool |

### 3.4 (d) Specific risks of harm to those persons or groups

<!-- Guidance: Name the fundamental rights concerned (for example under the Charter of Fundamental Rights of the EU), the mechanism of harm and its severity and likelihood. -->

| ID | Risk of harm | Groups | Rights concerned | Severity (1 to 5) | Likelihood (1 to 5) | Rating |
|---|---|---|---|---|---|---|
| FR-01 | *Example:* Higher false flag rate for applicants with foreign documents, delaying support | AP-03, AP-02 | Non-discrimination; social security and social assistance | 4 | 3 | 12 |
| FR-02 | *Example:* Applicants not told that a system was used and cannot contest it | AP-01 | Good administration; effective remedy | 3 | 3 | 9 |
| FR-03 | *Example:* Excessive data use beyond what the process needs | AP-01, AP-02 | Private life; protection of personal data | 3 | 2 | 6 |
| FR-04 | *Example:* Delays affecting children's housing stability | AP-02 | Rights of the child | 4 | 2 | 8 |
| FR-05 | *Example:* Staff treat flags as findings of fraud | AP-01 | Presumption of good faith; dignity | 3 | 3 | 9 |

Ratings are severity times likelihood: 1 to 4 low, 5 to 9 medium, 10 to
15 high, 16 to 25 very high.

### 3.5 (e) Human oversight measures

[Describe the oversight measures implemented according to the provider's
instructions for use.]

| Measure | Who | Competence and authority | Evidence |
|---|---|---|---|
| *Example:* Every flagged application reviewed by a verification officer before any request to the applicant | Verification team | 1-day training on the system's limitations; authority to dismiss flags | Training records |
| *Example:* Flag shown with top contributing factors, never as "fraud" | Interface | n/a | Screen design |
| *Example:* Weekly sample of 50 non-flagged applications reviewed | Team lead | Authority to suspend the system | Sample log |
| *Example:* Monthly monitoring of flag rate by group | Data analyst | Reports to steering group | Dashboard |
| *Example:* Ability to stop use and revert to manual triage | Head of service | Documented in runbook | Runbook |

### 3.6 (f) Measures if the risks materialise

<!-- Guidance: Include internal governance arrangements and complaint mechanisms, as Article 27(1)(f) requires. -->

| Risk | Detection | Response | Owner |
|---|---|---|---|
| FR-01 | Flag rate for AP-03 more than 1.25 times overall rate for two months | Raise threshold for affected group pending provider fix; inform provider; review affected cases | Head of service |
| FR-02 | Complaints or audit finding | Correct notices; reopen affected decisions on request | Legal |
| FR-05 | Sample shows flags treated as fraud findings | Retraining; disciplinary process if needed | Team lead |
| Any serious incident | Staff report, complaint, monitoring | Stop use if needed; inform provider and authorities as required by the Regulation (Article 26) | Senior accountable officer |

Governance arrangements: [*Example:* a steering group (head of service,
DPO, legal, equality officer) meets monthly for the first six months, then
quarterly, and can suspend use.]

Complaint mechanisms: [*Example:* applicants can complain online, by phone
or in person; complaints mentioning the system are tagged and reviewed
within 10 working days; the normal administrative appeal remains
available; applicants are informed of their right to an explanation of
individual decisions under Article 86 where it applies.]

## 4. Rights-by-rights analysis

<!-- Guidance: A cross-check that no relevant right was missed. Mark each right as relevant or not, with a short reason. -->

| Right (EU Charter) | Relevant? | Linked risks | Comment |
|---|---|---|---|
| Human dignity | [Yes / No] | FR-05 | |
| Respect for private and family life | [Yes / No] | FR-03 | |
| Protection of personal data | [Yes / No] | FR-03 | See DPIA |
| Non-discrimination | [Yes / No] | FR-01 | |
| Rights of the child | [Yes / No] | FR-04 | |
| Integration of persons with disabilities | [Yes / No] | | |
| Social security and social assistance | [Yes / No] | FR-01 | |
| Right to good administration | [Yes / No] | FR-02 | |
| Right to an effective remedy | [Yes / No] | FR-02 | |
| Freedom of expression and information | [Yes / No] | | Usually not relevant for this use |

## 5. Relationship to the DPIA

<!-- Guidance: Article 27(4), as amended by Regulation (EU) 2026/1744, lets the deployer include cross-references to the relevant sections of an existing DPIA under GDPR Article 35 (or Article 27 of Directive (EU) 2016/680) where it already covers an obligation. Reference the DPIA rather than duplicating it. -->

| Item | Value |
|---|---|
| DPIA reference | [DPIA-ID, version, date] |
| Sections reused | *Example:* Description of processing (DPIA 2), necessity and proportionality (DPIA 4), data security measures (DPIA 7) |
| What this FRIA adds | *Example:* Non-discrimination analysis, rights of the child, good administration, complaint handling |
| DPO opinion | [Summary] |

## 6. Notification to the market surveillance authority

<!-- Guidance: Article 27(3) requires the deployer to notify the market surveillance authority of the results, submitting the filled-out template referred to in Article 27(5). An exemption may apply in the case referred to in Article 46(1). -->

| Item | Value |
|---|---|
| Market surveillance authority | [Name, Member State] |
| Template used | [AI Office questionnaire template, version / not yet available] |
| Date submitted | YYYY-MM-DD |
| Reference number | [Reference] |
| Exemption claimed (Article 46(1)) | [No / Yes, with justification] |
| Submitted by | [@name] |
| Confirmation received | [Yes / No], YYYY-MM-DD |

## 7. Review and update

<!-- Guidance: List the events that make an element outdated and the scheduled reviews. -->

| Trigger | Elements affected | Action |
|---|---|---|
| New system version from provider | (d), (e) | Review provider information; update risks |
| Change in process or user group | (a), (c) | Update and re-notify if results change |
| Extension of period or frequency | (b) | Update |
| Monitoring threshold breached | (d), (f) | Reassess; consider suspension |
| Annual review | All | Confirm or update |

## 8. Conclusion

<!-- Guidance: Summarise the overall result and the conditions for use. -->

| Item | Value |
|---|---|
| Overall assessment | [*Example:* Use may proceed; two risks rated medium-high after measures] |
| Conditions | *Example:* Group monitoring for FR-01 live before first use; notice wording approved by legal |
| Residual concerns | [Summary] |
| Decision | [@senior-accountable-officer], YYYY-MM-DD |

## 9. Glossary and references

<!-- Guidance: Define terms for non-specialist readers and list the sources consulted. -->

| Term | Meaning |
|---|---|
| Deployer | A person or body using an AI system under its authority in a professional activity |
| Provider | The organisation that develops the AI system and places it on the market under its name |
| FRIA | Fundamental rights impact assessment under Article 27 of the AI Act |
| DPIA | Data protection impact assessment under Article 35 GDPR |
| Market surveillance authority | National authority that supervises AI systems on the market |

References: Regulation (EU) 2024/1689 as amended by Regulation (EU)
2026/1744 (consolidated text), Articles 6, 13, 26, 27, 46, 86, 113 and
Annex III; Charter of Fundamental Rights of the European Union;
Regulation (EU) 2016/679 (GDPR), Article 35; [provider's instructions
for use]; [DPIA].

## Standard and licence note

Based on Regulation (EU) 2024/1689 (the Artificial Intelligence Act) as
amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI),
Article 27 on the fundamental rights impact assessment for high-risk AI
systems, as published in the Official Journal of the European Union; EU
legislative texts are free to reuse. The required elements are
summarised in original wording and no text of the Regulation is
reproduced. Check the consolidated text on EUR-Lex for the binding
wording, any later amendments and the AI Office template; under the
amended Article 113 the obligation applies from 2 December 2027 for the
Article 6(2) (Annex III) systems it covers. This is a
documentation format, not legal advice. Template licence: MIT.