Society GUIDE
Fundamental Rights Impact Assessment Under Article 27
Article 27 requires specified deployers to assess fundamental-rights impacts before first use of covered high-risk AI systems.
On this page3 min read
Overview
The duty has defined organisation and system scopes, permits reuse or cross-reference of certain existing assessments, and requires notice to the market-surveillance authority subject to a statutory exception.
Deep Dive
Article 27 of Regulation (EU) 2024/1689 establishes a fundamental-rights impact assessment (FRIA) for specified deployers of certain high-risk systems classified under Article 6(2) and Annex III. Before deployment, the duty applies to bodies governed by public law and private entities providing public services, except for systems intended for the Annex III point 2 area. It also applies to deployers of high-risk systems in Annex III points 5(b) and 5(c), covering creditworthiness assessment of natural persons and risk assessment or pricing in life and health insurance. These system-specific categories are not restricted to public bodies.
The assessment describes the use process, intended period and frequency, the people and groups likely to be affected, likely harms in that context using provider information, how human oversight will work, and measures if risks materialise, including internal governance and complaint mechanisms. The duty applies to first use. A deployer may rely on prior FRIAs or provider assessments in similar cases, but must update information when a listed element changes or becomes out of date. After assessment, the deployer notifies the market-surveillance authority with the prescribed template; Article 46(1) can provide an exception to notification.
A FRIA is distinct from a data-protection impact assessment (DPIA). If a GDPR or law-enforcement DPIA already meets some Article 27 obligations, the deployer may cross-reference those parts or include them. This prevents needless duplication but does not erase the FRIA’s distinct scope and content. As amended, Article 27 also directs the AI Office’s template to support such cross-referencing. The high-risk rules containing Article 27’s operational obligation apply on the delayed timetable: for Annex III Article 6(2) systems, from 2 December 2027 under Regulation 2026/1744.
Strategic Impact
Risk and safety
Catastrophic and everyday AI harms both depend on who understands the risks and who can act.
Clearer decisions
Public and professional literacy shapes whether strong safety policy is politically possible.
Cutting through hype
Clear explanations reduce capture by hype, lab PR, and vague ethics theater.
The Future of Fundamental Rights Impact Assessment Under Article 27
The AI Office is to develop a questionnaire template, potentially through an automated tool, to simplify Article 27 compliance and support cross-references to DPIAs. That template facilitates the statutory duty; it does not change which deployers are in scope or turn the assessment into a general requirement for every AI use. Monitor official template publication and local market-surveillance processes. Deployer teams should check the final questionnaire and local notification channel before first use. Official implementation materials can make the process easier, but they cannot widen or remove Article 27’s statutory scope.
Real-World Implementation
A public authority deploying an Annex III high-risk system for a public service documents affected groups, harms, human oversight and complaint arrangements before first use.
A private credit provider using an Annex III creditworthiness system assesses impacts even though it is not itself a public-service body.
A deployer reuses a similar prior assessment but updates it because the new context affects a different group.
A team cross-references relevant GDPR data-protection impact-assessment sections while separately completing the Article 27 assessment.
Risks & Guardrails
Treating existential risk as sci-fi while capability compounds.
Confusing surface product safety with alignment under high autonomy.
Leaving non-English and non-expert audiences with only low-quality sources.
Implementation Roadmap
Separate product harms, misuse, and loss-of-control / misalignment risks.
Ask what evidence would change your view on timelines and severity.
Prefer primary sources and concrete evals over marketing claims.
Identify one action path: career, policy, funding, or skills — not only awareness.
Keep Exploring
Free newsletter
Keep up with AI in 3 minutes a day
One short email each weekday with the three AI stories that actually matter. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the Fundamental Rights Impact Assessment Under Article 27 quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Frequently asked questions
What is Fundamental Rights Impact Assessment Under Article 27?
Article 27 requires specified deployers to assess fundamental-rights impacts before first use of covered high-risk AI systems. The duty has defined organisation and system scopes, permits reuse or cross-reference of certain existing assessments, and requires notice to the market-surveillance authority subject to a statutory exception.
Which deployer is within Article 27’s public-service scope route?
Article 27 covers public-law bodies and private entities providing public services, with a stated exception for Annex III point 2 systems.
Which use categories can trigger Article 27 regardless of whether the deployer is a public-service body?
Article 27 separately covers Annex III points 5(b) and 5(c).
When must an in-scope deployer complete the assessment?
Article 27 requires assessment prior to deploying and says the obligation applies to first use.
Which item belongs in the Article 27 assessment?
The assessment identifies affected groups and likely harms in the specific use context.
What must the assessment say about mitigation and governance?
Article 27 lists response measures, governance arrangements and complaint mechanisms.
Keep learning
Related guides
More guides picked for this topic