Fundamental rights impact assessment (FRIA) under the EU AI Act: who must do one, and the six contents
Who is in scope
| Deployer | FRIA needed? |
|---|---|
| Public authority using an Annex III high-risk system | Yes (except critical infrastructure, Annex III point 2) |
| Private company providing a public service (for example education, health or housing services) | Yes, for Annex III systems |
| Lender, NBFC, credit union or BNPL using AI to score individuals' creditworthiness | Yes (Annex III 5(b); fraud detection excluded) |
| Insurer using AI for life or health insurance risk and pricing | Yes (Annex III 5(c)) |
| SME using AI for marketing copy or a website chatbot | No (not high-risk; Article 50 transparency may apply) |
The six contents (Art. 27(1))
- How and for what purpose the system is used in your processes
- How long and how often it will be used
- Which groups of people are likely to be affected
- Specific risks of harm to those groups (using the provider's instructions)
- How human oversight is carried out
- What you will do if the risks materialise, including internal governance and complaint handling
Practical points
- You can rely on an earlier FRIA, or one from the provider, for similar cases, but update it when something changes.
- If you already ran a GDPR DPIA, the FRIA complements it rather than repeating it (Art. 27(4)).
- The AI Office is to provide a template questionnaire for notifying results.
Accountants and advisers: who to flag now
- Clients in lending or credit scoring
- Clients selling or pricing life or health insurance
- Clients delivering public services under contract
- Each one: record the AI system, provider and use in an inventory
Regulation (EU) 2026/1744 moved the high-risk dates; see what applies now. Read Article 27 in the current consolidated text on EUR-Lex.
Frequently asked questions
Who must carry out a fundamental rights impact assessment under the EU AI Act?
Public bodies and private entities providing public services that deploy Annex III high-risk AI (except critical infrastructure), and deployers using AI for credit scoring of individuals or for life and health insurance risk assessment and pricing.
When must the FRIA be done?
Before the high-risk AI system is first used, and it must be updated if relevant elements change.
Is a FRIA the same as a GDPR DPIA?
No. Article 27(4) says the FRIA complements an existing data protection impact assessment.
Does a small business using ChatGPT need a FRIA?
Normally no. General office or marketing use is not an Annex III high-risk use; transparency duties under Article 50 may apply instead.
Official sources
- EUR-Lex: Regulation (EU) 2024/1689 (AI Act), Article 27 and Annex III
- European Commission: AI regulatory framework
- European Commission: European AI Office
Not tax or legal advice. This is a free explainer of public rules; deadlines and rules can change by notification, so confirm on the official portal or with your CA before you file. Last checked 20 Oct 2026.
Get free deadline reminders. Free: one short email every Wednesday listing the GST, TDS and ITR due dates coming up. Unsubscribe anytime.
Subscribe free on Gumroad (email only, no payment).
Or put every date in your calendar now: free India tax deadline calendar (Google Calendar, Outlook, phone; .ics + spreadsheet).
If you want a ready-made tool
Start the inventory and risk screen behind a FRIA in one workbook: EU AI Act Readiness Kit (paid, US$29).
Unadhi Guides are free, independent explainers. Not an official government publication. We correct errors as soon as we find them: write to mininglife7@gmail.com.
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.