Fundamental Rights Impact Assessment (FRIA) Under the EU AI Act: Who Must Comply and How

If your organisation deploys a high-risk AI system — or falls within one of the categories Article 27 specifies — you must complete a Fundamental Rights Impact Assessment (FRIA) before the system goes into first use. This is not optional. The FRIA is a distinct EU AI Act obligation with its own scope, required contents, and a non-negotiable deadline of “before first use.”

For mid-market EU companies (50–500 employees) using or considering AI tools in credit-scoring, HR screening, or public-service contexts, the FRIA is one of the most concrete compliance deliverables of the AI Act. This article explains what a FRIA is, who must complete one, what it must contain, how it differs from a DPIA, and how to walk through the process in practice.

What is a Fundamental Rights Impact Assessment (FRIA)?

The FRIA is the deployer’s obligation under Article 27 of the EU AI Act to evaluate, before deploying a high-risk AI system, the impact that system could have on fundamental rights. “Fundamental rights” here means the rights protected by the EU Charter of Fundamental Rights — including non-discrimination, data protection, freedom of expression, and the right to an effective remedy.

A FRIA is not a one-time form. You must complete it before first use, keep it updated, and review it when circumstances change — for example, when the system’s scope expands or new risk categories emerge.

Who must conduct a FRIA?

Article 27 applies the FRIA obligation to three categories of deployers of high-risk AI systems:

1. Public bodies and public authorities — any public entity deploying a high-risk AI system.
2. Private entities that provide public services — for example, a private company running a public procurement system.
3. Deployers of specific Annex III systems — regardless of public or private status, if the system falls under: - Annex III, paragraph 5(b): credit-scoring systems. - Annex III, paragraph 5(c): life and health insurance risk-assessment and pricing systems.

If your company is a private-sector deployer not in these categories, there is no legal FRIA requirement — though many organisations conduct one voluntarily as a governance best practice.

The six things Article 27 says a FRIA must contain

The AI Act is specific about what a FRIA must address:

1. A description of the AI system — what it does, how it works at a high level, and its intended purpose.
2. The periods and dates of intended use — when the system will be deployed, for how long, and whether it is ongoing or one-off.
3. The categories of persons and groups likely to be affected — for example, loan applicants, insured persons, or employees.
4. The specific risks of harm to those categories — what could go wrong, for whom, and how severe or likely those harms are. This must address discrimination, privacy impacts, and other fundamental-rights risks.
5. Human oversight measures — who has the authority to intervene, override, or shut down the system.
6. Steps taken if risks materialise — remediation procedures, complaint channels, and escalation paths.

FRIA vs DPIA: what is the difference?

Deployers frequently ask whether a FRIA replaces a DPIA under GDPR Article 35. It does not — they are distinct obligations. However, they overlap, and a single exercise can often address both.

If you are deploying a credit-scoring AI, you almost certainly need both. Regulators will expect to see both documents.

A 7-step practical walkthrough

Step 1 — Scope the assessment. Identify the AI system, its intended purpose, and the deployment context. Document the version, the vendor, and the specific use case.

Step 2 — Map the affected persons and groups. Who will be subject to decisions made by the system? In credit scoring, this includes loan applicants, guarantors, and co-applicants. In HR screening, it includes job applicants and existing employees.

Step 3 — Assess specific risks of harm. For each affected group, identify fundamental-rights risks: discrimination (direct and indirect), denial of access to essential services, privacy violations, and chilling effects on other rights.

Step 4 — Define human oversight measures. Identify who will oversee the system, what their qualifications are, what decisions they can override, and under what circumstances the system should be shut down.

Step 5 — Define mitigation and remediation steps. For each identified risk, document what you have done to reduce it and what happens if a harmful outcome materialises — including complaint channels and compensation pathways.

Step 6 — Document the FRIA. Produce the written assessment covering all six Article 27 elements. It should be clear enough that a regulator or auditor can follow your reasoning.

Step 7 — Set a review cycle. Review and update the FRIA when the system’s use changes, new risks emerge, or at regular intervals. Many organisations set a 12-month baseline.

What good looks like: two case studies

Case 1: A credit-scoring deployer

A mid-sized European fintech uses a third-party AI model to score loan applications. The system falls under Annex III 5(b), so a FRIA is mandatory.

The FRIA describes the scoring model, the three-year deployment period, and affected persons (loan applicants, guarantors, co-applicants). It identifies the risk of discriminatory outcomes — for example, lower scores for applicants from certain nationalities or postcodes — and the risk that applicants are denied credit without meaningful explanation. Human oversight is structured around a three-person credit committee that reviews all applications where the AI score falls below a defined threshold. Mitigations include quarterly bias testing, an applicant complaint channel, and a documented process for manual review. The FRIA is reviewed every six months and updated after any model retraining.

Case 2: An HR-screening deployer

A 300-employee manufacturing company uses an AI tool to screen CVs and rank candidates. The FRIA describes the screening tool, the ongoing deployment period, and affected persons (all applicants for open roles). It identifies the risk of indirect discrimination — the tool penalising non-traditional career paths, disadvantaging older applicants or those returning from parental leave. Human oversight is provided by the HR manager, who reviews AI-generated rankings before shortlisting. Mitigations include vendor bias-testing reports, a disclosure in job postings that AI is used in screening, and a dedicated applicant complaint email. The FRIA is reviewed annually.

Frequently asked questions

Do I need a FRIA if I am a private company with no public-service obligations?

Not necessarily. Article 27 requires a FRIA only if you are a public body, a private entity providing public services, or a deployer of a credit-scoring or life/health insurance risk-assessment system. If none apply, there is no legal requirement — though you may still choose to conduct one.

When must the FRIA be completed?

Before first use of the high-risk AI system. You cannot deploy the system and complete the FRIA afterwards. Plan your assessment timeline to precede deployment.

Can I use my existing DPIA as a substitute for a FRIA?

No. The FRIA and DPIA are distinct legal obligations with different scopes. A DPIA addresses personal-data processing risks; a FRIA addresses fundamental-rights impacts broadly. You can structure assessments to share common elements and reference each other, reducing duplication.

What happens if I do not complete a FRIA?

From 2 August 2026, non-compliance penalties include fines of up to €15 million or 3% of global annual turnover. Failure to conduct a required FRIA is a compliance breach. Beyond fines, you risk reputational damage and private litigation if fundamental rights are violated.

How often should I update the FRIA?

At minimum, review it when the system’s scope changes, new risks emerge, or the AI model is retrained. Many organisations adopt a 12-month or 6-month review cycle as a baseline.

To streamline your FRIA process with structured templates, automated risk-mapping, and audit-ready documentation, consider Renomira — the EU AI Act compliance platform built for mid-market companies.