Fundamental Rights Impact Assessment Under Article 27

Article 27 of Regulation (EU) 2024/1689 establishes a fundamental-rights impact assessment (FRIA) for specified deployers of certain high-risk systems classified under Article 6(2) and Annex III. Before deployment, the duty applies to bodies governed by public law and private entities providing public services, except for systems intended for the Annex III point 2 area. It also applies to deployers of high-risk systems in Annex III points 5(b) and 5(c), covering creditworthiness assessment of natural persons and risk assessment or pricing in life and health insurance. These system-specific categories are not restricted to public bodies. The assessment describes the use process, intended period and frequency, the people and groups likely to be affected, likely harms in that context using provider information, how human oversight will work, and measures if risks materialise, including internal governance and complaint mechanisms. The duty applies to first use. A deployer may rely on prior FRIAs or provider assessments in similar cases, but must update information when a listed element changes or becomes out of date. After assessment, the deployer notifies the market-surveillance authority with the prescribed template; Article 46(1) can provide an exception to notification. A FRIA is distinct from a data-protection impact assessment (DPIA). If a GDPR or law-enforcement DPIA already meets some Article 27 obligations, the deployer may cross-reference those parts or include them. This prevents needless duplication but does not erase the FRIA’s distinct scope and content. As amended, Article 27 also directs the AI Office’s template to support such cross-referencing. The high-risk rules containing Article 27’s operational obligation apply on the delayed timetable: for Annex III Article 6(2) systems, from 2 December 2027 under Regulation 2026/1744.