FRIA: fundamental rights impact assessment in the public sector

Short answer: Article 27 of Regulation (EU) 2024/1689 (the EU AI Act) requires public authorities and private entities providing public services to conduct a Fundamental Rights Impact Assessment (FRIA) before first deploying a high-risk AI system. The FRIA must map risks to all rights protected by the EU Charter of Fundamental Rights and be notified to the national market surveillance authority. The obligation applies from 2 August 2026.

Who is obliged?

Article 27 targets three categories of deployers. First: public authorities and other bodies governed by public law that deploy high-risk AI systems. Second: private organisations providing public services — such as education, healthcare, social security, housing, or the administration of justice. Third: all deployers, regardless of legal form, using AI systems for creditworthiness assessment or risk pricing in life and health insurance. Systems falling under point 2 of Annex III (safety components of critical digital infrastructure, road traffic management, water and energy supply) are explicitly excluded from the FRIA obligation.

What must a FRIA contain?

The regulation prescribes six mandatory elements:

1. A description of the deployer's processes in which the high-risk AI system will be used, in line with its intended purpose.
2. The duration and frequency of the intended use.
3. The categories of natural persons and groups likely to be affected.
4. The specific risks of harm to those categories, including risks of discrimination or violation of privacy.
5. How human oversight is implemented in accordance with the provider's instructions for use.
6. Measures to address materialised risks, including complaint mechanisms and governance arrangements.

Notification requirement and relation to the DPIA

Upon completion, the deployer must notify the results to the competent market surveillance authority. The European AI Office is developing a standardised questionnaire template for this purpose. The FRIA is complementary to — and does not replace — the Data Protection Impact Assessment (DPIA) required under Article 35 GDPR: both instruments may be required simultaneously. The FRIA covers the full EU Charter of Fundamental Rights; the DPIA is limited to privacy and personal data.

Timeline

The obligations for high-risk AI systems, including Article 27, apply from 2 August 2026. The FRIA must be carried out before first deployment; for repeated use in comparable contexts, a previously conducted assessment may be relied upon provided it is kept up to date.