What must a fundamental rights impact assessment contain under Article 27?

Download it, with no email asked

• FRIA outline: Article 27(1), point by point, Markdown

What is in it

Does Article 27 reach you?

• You deploy a high-risk AI system referred to in Article 6(2), and it is not intended to be used in the area listed in point 2 of Annex III.
• And you are a body governed by public law or a private entity providing public services, or the system is referred to in points 5(b) and (c) of Annex III: evaluating the creditworthiness of natural persons or establishing their credit score, other than for detecting financial fraud, and risk assessment and pricing for natural persons in life and health insurance.
• An Annex III system that Article 6(3) takes out is not high-risk, and Article 27(1) refers to Article 6(2), so a system high-risk only under Article 6(1) and Annex I is outside it.
• When: prior to deploying, for the first use (Article 27(1) and (2)), and from 2 December 2027 (Article 113, third paragraph, point (c)(i), as replaced by Regulation (EU) 2026/1744).

Provision: Article 27(1)

Point (a): your processes

• Describe your processes in which the high-risk system will be used, in line with its intended purpose.
• Practice: name the owner of each process and where the system's output goes in it.
• Practice: quote the intended purpose from the provider's instructions for use.

Provision: Article 27(1), point (a)

Point (b): period and frequency

• Describe the period of time within which the system is intended to be used.
• Describe the frequency with which it is intended to be used.
• Practice: name what would change either, such as a new market or a new team.

Provision: Article 27(1), point (b)

Point (c): who is likely to be affected

• List the categories of natural persons and groups likely to be affected by its use in this specific context.
• Practice: include people who never use the system but are decided about with it.

Provision: Article 27(1), point (c)

Point (d): the specific risks of harm

• For the categories of persons or groups identified under point (c), describe the specific risks of harm likely to have an impact on them.
• Take into account the information the provider gives under Article 13.
• In the instructions for use, look in particular at the known or foreseeable circumstances that may lead to risks to health and safety or fundamental rights (Article 13(3), point (b)(iii)) and, when appropriate, its performance regarding specific persons or groups (Article 13(3), point (b)(v)).

Provision: Article 27(1), point (d)

Point (e): human oversight

• Describe how the human oversight measures are implemented, according to the instructions for use.
• The instructions for use contain the human oversight measures referred to in Article 14 (Article 13(3), point (d)).
• Name the people assigned to oversight: Article 26(2) requires the necessary competence, training and authority, as well as the necessary support.

Provision: Article 27(1), point (e)

Point (f): if the risks materialise

• Describe the measures to be taken if those risks materialise.
• Include the arrangements for internal governance.
• Include the complaint mechanisms.

Provision: Article 27(1), point (f)

Keeping it current

• The obligation applies to the first use of the high-risk system.
• In similar cases you may rely on a fundamental rights impact assessment done before, or on an existing impact assessment carried out by the provider.
• If during use you consider that any element listed in Article 27(1) has changed or is no longer up to date, take the necessary steps to update the information.

Provision: Article 27(2)

Notifying the authority

• Once the assessment is performed, notify the market surveillance authority of its results, submitting the filled-out template referred to in Article 27(5) as part of the notification.
• In the case referred to in Article 46(1), deployers may be exempt from that obligation to notify. Article 46(1) lets a market surveillance authority, upon a duly justified request and for the exceptional reasons that paragraph lists, authorise a specific high-risk system in its Member State for a limited period while the conformity assessment procedures are carried out.

Provision: Article 27(3)

Using your DPIA

• If your data protection impact assessment under GDPR Article 35 or Article 27 of Directive (EU) 2016/680 already meets an obligation of Article 27, you may cross-refer to its relevant sections or include its relevant parts in this assessment.
• The data protection impact assessment does not take this assessment's place: Article 27(1) still requires it.

Provision: Article 27(4), as replaced by Regulation (EU) 2026/1744

The AI Office template

• The AI Office is to develop a template for a questionnaire, including through an automated tool, to help deployers comply with Article 27 in a simplified manner.
• Where relevant, the template is to let deployers cross-refer to the data protection impact assessment or include its relevant parts.
• Article 27(5) sets no date for it, and whether it has been published was not checked against our sources.

Provision: Article 27(5), as replaced by Regulation (EU) 2026/1744

The same work, in the app

For each system whose classification a person has confirmed, Complipath says whether a fundamental rights impact assessment is Required, Likely or Not required for you, prints Article 27(1) beside the answer and names the fact that decides a Likely, such as whether you are a body governed by public law or a private entity providing public services; it does not draft the assessment. DPIA and FRIA: whether they apply.

The provisions it names

Article 6(2) and (3); Article 13(3); Article 26(2); Article 27(1), (2) and (3); Article 27(4) and (5), as replaced by Regulation (EU) 2026/1744; Article 46(1); Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744; points 2, 5(b) and 5(c) of Annex III. Each is in Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.