A FRIA is mandatory, and 2 August 2030 is a hard backstop.
As a public body you owe a fundamental rights impact assessment for every high-risk system, must publish a summary, and face a hard compliance backstop on 2 August 2030 with no further deferral.
- Annex
- Annex III — all categories, plus public-service deployment
- Provisions
- Art. 27(1)(a) · Art. 27(3) · Art. 111(2) · Art. 26
- Pack
- €199/month add-on · 4 duties · 1 notice templates
Why this sector is different
Public bodies are the one category where the FRIA is unconditional for every high-risk system, and where a summary must be published. Procurement rules, transparency obligations and political scrutiny all apply on top.
Complete a FRIA for every high-risk system before first use
Conditional exemptions do not apply to public bodies.
Art. 27(1)(a) · due within 21 days of activation
Publish the FRIA summary
Publication is part of the duty, not optional transparency.
Art. 27(3) · due within 30 days of activation
Review social-scoring and predictive-policing proposals for Art. 5
Both categories are prohibited outright, and both get proposed in a public sector context.
Art. 5(1)(c) · Art. 5(1)(d) · due within 14 days of activation
Add AI Act evidence clauses to public procurement
The cheapest time to demand Annex IV documentation is before the contract is signed.
Art. 26(1) · Annex IV · due within 60 days of activation
The notices you owe
Unlocked with the pack, rendered with your own facts, blanks kept where you must decide.
The public
Published FRIA summary
{company} has completed a fundamental rights impact assessment under Article 27 for {system}, used for {purpose}. The assessment identifies the affected groups, the risks to fundamental rights considered, the human oversight measures and the …
What your buyers will ask
The questions that stall a deal or trigger an audit. Each one is a control in the matrix.
- ?Where is the published FRIA summary?
- ?Who is the named overseer for each system?
- ?How do citizens challenge an automated decision?
Straight answers
Do all our AI systems need a FRIA?
Every high-risk system does. Public bodies are not in the conditional category: Article 27(1)(a) applies to you directly, and Article 27(3) requires a summary to be published.
What is the 2030 backstop?
Article 111(2), as amended, provides that providers and deployers of high-risk AI used by public authorities must be compliant by 2 August 2030. It is a backstop, not an extension: the ordinary high-risk dates already apply from 2 December 2027.
Know where you stand before the questions arrive.
Four minutes, no card. You get your exposure score and the exact articles that apply to a public sector organisation.