fundamental rights impact assessment (FRIA)

advancedspreading

A preliminary assessment of who could have their fundamental rights infringed by the use of a high-risk AI system, and how, and what is done to prevent it; mandatory for a defined group of deployers.

In plain terms

Before a public office or bank deploys an AI system that decides or prepares decisions about people's lives, it must describe who it could harm and how. This is the fundamental rights impact assessment. The EU Artificial Intelligence Act (AI Act) mandates it.

It is like an environmental impact assessment before construction. There, one must examine what will happen to the groundwater and the neighbors; here, what will happen to the rights of those affected: equal treatment, privacy, human dignity, and the possibility of legal redress.

The obligation does not fall on the system manufacturer but on the entity using it for its own clients or cases. The same software means something different in a benefit adjudication office than in a credit assessment. The investigation therefore concerns the specific use case, not the technology in general.

How it works

The using organization describes in which process, for what purpose, for how long, and how often it will use the system.
It identifies which individuals and groups are affected by its use, including vulnerable people such as the elderly, children, or those with disabilities.
Identifies specific harms they may face: discrimination, wrongful rejection, privacy violations.
It records how humans oversee the system and what happens if something goes wrong: who is responsible and where complaints can be filed.
The assessment must be carried out before first use. The organization notifies the market surveillance authority of the result, and if circumstances change significantly, it updates the assessment.

An everyday example

You apply for a loan, and the bank uses an AI system to score how reliable a borrower you are. Once the rule applies, before first live use the bank must assess, for example, whether the system unfairly penalizes people living in small settlements or elderly people, and who reviews contested decisions as a human.

Who is affected

lawyer, citizenIf a public authority uses a high-risk AI system in your case, this assessment must precede its use and can serve as a basis for citation in a legal dispute. → Law

bank customer, investorAI systems that score creditworthiness or calculate life and health insurance risks and premiums are subject to mandatory audits even at private companies. → Money

entrepreneur, executiveIf your company provides a public service and uses a high-risk AI system for this, or uses AI for credit assessment or life and health insurance pricing, you must carry out the assessment, not the software supplier.

developerYour client works from your documentation and user manual, so they will ask you for information about the system's limitations and errors. → Code

A common misconception

MythEvery company using AI must conduct a fundamental rights impact assessment.

In realityIt is mandatory only for specified users of high-risk systems: public authorities, private companies providing public services, and those using AI to assess creditworthiness or life/health insurance risk. Systems controlling critical infrastructure (such as power or water supply) are exempt. A customer service chatbot or a text-writing agent alone does not require it.

Limits and risks

The organization examines itself; the authority only receives notification and grants no prior approval, so the quality of the examination can be very uneven.
The full investigation does not have to be made public. Public bodies only need to upload a summary to the EU public database, and private companies do not even need to do that, so as an affected party you typically cannot access the details.
Good paperwork is no guarantee: an assessment covers risks estimated in advance, while actual faults often emerge only during use.
It can easily become a formal checkbox exercise if the organization covers it with template text. The regulation only recommends, not requires, consulting affected parties.

Similar, but not the same

data protection impact assessment – Under the GDPR, this assesses risks in personal data processing, whereas the fundamental rights impact assessment examines all fundamental rights, complementing rather than replacing it.
conformity assessment – The system provider (manufacturer) carries out the technical requirements assessment before market launch, while the user conducts the fundamental rights impact assessment for their own specific use case.
algoritmikus audit – An audit is a retrospective examination of an already operating system, often conducted by external experts, whereas an impact assessment is a survey conducted before use begins.

Related concepts

Broader

EU MI-rendelet (AI Act), AI regulation, Risk-based approach, responsible AI

Narrower

–

On the edge

High-risk AI system, data protection impact assessment, human oversight, algorithmic bias, transparency

A brief history

The fundamental rights impact assessment became a legal obligation under Article 27 of the EU Artificial Intelligence Act; the regulation was adopted in 2024 and entered into force on August 1, 2024. The article was included in the text during legislative negotiations under pressure from the European Parliament.

Where things stand

The obligation will apply alongside rules for high-risk systems. Their original deadline was August 2, 2026, but the EU's digital simplification (omnibus) package postponed it: for systems covered here, such as credit scoring and public services, the new date is December 2, 2027. By the end of 2026, organizations are still primarily preparing: they are testing methodologies and templates; established practices do not yet exist.

Status: 2026 November

In the news

Appears in 2 Agent Age stories; the curve shows weekly occurrence in the news magazine.

EU AI Act: which school and university AI counts as high-riskOct 14, 2026 · Education & Family
Dutch regulator outlines process for AI Act fundamental rights impact assessment (FRIA)Aug 24, 2026 · Jog

Also known as

fundamental rights impact assessment · FRIA · fundamental rights impact assessment · Fundamental rights impact assessment · Fundamental rights impact assessment · fundamental rights impact assessment · impact assessment under Article 27 of the AI Act

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.