Fundamental Rights Impact Assessment Under the EU AI Act
Who this applies to
This obligation applies to
providers and
deployers of
high-risk AI systems (as defined in
Article 6(1)) and
public sector entities using AI in areas listed in
Annex III (e.g., critical infrastructure, law enforcement, employment). The requirement is explicitly set out in
Article 27(1) and
Article 29(1).
What is required
- Conduct a Fundamental Rights Impact Assessment (FRIA) before placing a high-risk AI system on the market or putting it into service, as mandated by Article 27(1).
- Document the assessment in a detailed, written report, including:
- The
purpose and intended use of the AI system (
Article 27(2)(a)).
- An analysis of
potential impacts on fundamental rights (e.g., non-discrimination, privacy, freedom of expression) (
Article 27(2)(b)).
-
Mitigation measures to address identified risks (
Article 27(2)(c)).
-
Consultation with affected stakeholders (where applicable) (
Article 27(2)(d)).
- Update the FRIA whenever there is a significant change in the AI system’s risk profile or use context (Article 27(3)).
- For public sector deployers, ensure the FRIA aligns with Article 29(1), which requires additional scrutiny for AI used in law enforcement, migration, or administration of justice.
- Retain FRIA documentation for 10 years after the AI system is placed on the market or decommissioned (Article 27(4)).
Key deadlines
The primary deadline for this obligation is
August 2, 2026.
Enforcement patterns
AI Act enforcement begins August 2, 2026. No precedent currently exists. This page will be updated as enforcement cases emerge.
Cross-border considerations
Implementation references for
Article 27 are most frequently cited in
Italy (8),
Netherlands (5), and
Austria (4), suggesting early national guidance may emerge from these jurisdictions.
Article 29 (public sector obligations) has higher citation density in
Romania (18),
Italy (15), and
Greece (6), indicating potential variation in public-sector enforcement priorities. No jurisdiction-specific deviations from the AI Act text have yet been documented.