Fundamental Rights Impact Assessment generator

# Fundamental Rights Impact Assessment (FRIA)

**Article 27, Regulation (EU) 2024/1689**

> **Scope warning — Article 27 may not apply to this deployment.**
>
> No Article 27 trigger selected. Article 27 applies only to (i) public bodies and private operators providing public services deploying Annex III high-risk systems, (ii) deployers of credit-scoring systems (Annex III §5(b)), and (iii) deployers of life/health insurance pricing systems (Annex III §5(c)). If none of those describe your deployment, a FRIA is not legally required under Article 27 — though a voluntary fundamental-rights assessment may still be advisable as part of an Article 26 deployer-obligations workflow.
>
> The remainder of this document is generated as a voluntary fundamental-rights assessment template. It should not be filed as an Article 27(3) notification unless you confirm the trigger applies.

| | |
|---|---|
| Organisation (deployer) | — |
| Deployer type | private-sector |
| AI system | — |
| Provider | — |
| Article 27 applicability | ⚠ No Article 27 trigger selected — see scope warning above. |
| Owner responsible | — |
| Review cadence | annually, and after any material change |
| Generated | 2026-09-09 |

---

## (a) Deployer processes in which the high-risk AI system is used (Art. 27(1)(a))

**Intended purpose (per provider instructions for use):** —

**Processes:** —

---

## (b) Period of time and frequency (Art. 27(1)(b))

- Start date: —
- Duration: —
- Frequency of use: —

---

## (c) Categories of natural persons and groups likely to be affected (Art. 27(1)(c))

**Primary categories:** —

**Vulnerable groups:** —

**Estimated reach (per period):** —

---

## (d) Specific risks of harm to those categories (Art. 27(1)(d))

This section reflects information provided by the provider under Article 13 (transparency obligations). Where provider information is missing or insufficient, the deployer must request it before deployment.

_No risks documented yet. The FRIA must list specific risks per affected category._

---

## (e) Human oversight measures (Art. 27(1)(e))

Per the provider's instructions for use under Article 13:

—

**Operator training and competence:**

—

---

## (f) Measures if risks materialise (Art. 27(1)(f))

**Internal governance:**

—

**Complaint mechanism (Art. 26(11)):**

—

**Notification obligations:**

—

---

## Notification to the market surveillance authority

Per Article 27(3), upon completion of this FRIA, the deployer must notify the market surveillance authority of the results using the template that the AI Office is to publish (Article 27(5)).

If the AI system has already been used and a previous FRIA covered the elements above, no new FRIA is required unless any of the elements change (Article 27(2)).

---

## Relationship to GDPR DPIA

Where the deployer is also a controller required to carry out a Data Protection Impact Assessment under Article 35 GDPR, the FRIA shall complement (not replace) that DPIA (Article 27(4)).

---

## Primary sources

- Regulation (EU) 2024/1689 (EU AI Act) — https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Article 27 (FRIA) — https://artificialintelligenceact.eu/article/27/
- Article 26 (deployer obligations) — https://artificialintelligenceact.eu/article/26/
- Article 13 (transparency to deployers) — https://artificialintelligenceact.eu/article/13/
- GDPR Article 35 (DPIA) — https://eur-lex.europa.eu/eli/reg/2016/679/oj

---

_This FRIA template is provided by aicompliancevendors.com. It is a starting point and not legal advice. Verify the analysis with counsel and the relevant market surveillance authority before relying on it._