EU AI Act Article 27 — Fundamental rights impact assessment for high-risk AI systems

Where this comes from

Who it applies to

What engineering work it implies

• FRIA / DPIA Assessment ScaffoldCovers it fully

  An assessment record carrying the Article 27(1)(a)-(f) headings and the WP248 DPIA sections in one artefact, stored with the project and linked to the evidence that...

Related obligations

Where the same control satisfies more than one framework — comply once, cover many.

• AIUC-1 AI Agent Certification StandardPartially covered by
  Test the agent internally before it goes live, record what the tests found, and get a named sign-off on the residual issues.C002 — Conduct pre-deployment testing (C. Safety)
• EU General Data Protection RegulationPartially covered by
  Carry out a data protection impact assessment before processing that is likely to result in a high risk to people's rights and freedomsArticle 35(1), (3) and (7) — Data protection impact assessment
• EU Artificial Intelligence ActRelated
  High-risk AI systems must be designed for effective human oversight including the ability to understand, monitor, interpret, override, and stop the systemArticle 14 — Human oversight
• EU Artificial Intelligence ActRelated
  Public-authority deployers must register themselves, select the system and register its use in the EU database before putting an Annex III high-risk AI system into service or using itArticle 49(3) — Registration of public-authority deployers and their use of the system
• EU Artificial Intelligence ActPrerequisite
  Every AI system must be classified against Article 6(2) and Annex III; a system in an Annex III area is high-risk unless a documented Article 6(3) derogation applies, and profiling of natural persons always makes it high-riskArticle 6(2)-(4) + Annex III — Classification of AI systems as high-risk

Evidence an auditor expects

• Assessment documentDocument reviewReviewed Art. 27(2): updated where the deployer considers any element has changed or is no longer up to date

  Fundamental rights impact assessment record covering the six elements of Art. 27(1)

  A completed assessment, performed PRIOR to deployment, containing: (a) a description of the deployer's processes in which the system will be used in line with its intended purpose; (b) the period and frequency of intended use; (c) the categories of natural persons and groups likely to be affected in the specific context; (d) the specific risks of harm to those categories, taking into account the information given by the provider under Art. 13; (e) a description of the implementation of human oversight measures according to the instructions for use; and (f) the measures to be taken if those risks materialise, including internal governance arrangements and complaint mechanisms

• Process recordDocument review

  Notification of the FRIA results to the market surveillance authority (Art. 27(3))

  Evidence of the notification and the filled-out template referred to in Art. 27(5), with the date sent and the authority notified. Art. 27(5) leaves the template to the AI Office — use the published template, do not substitute a local form

• Assessment documentDocument reviewRecommended

  Cross-reference to the GDPR Art. 35 DPIA where one exists (Art. 27(4))

  Mapping showing which Art. 27(1) elements are already met through the DPIA conducted under GDPR Art. 35, so the FRIA complements rather than duplicates it — and, conversely, which fundamental-rights elements the DPIA does not reach

Questions people ask

Does EU AI Act Article 27 — Fundamental rights impact assessment for high-risk AI… apply to my service?

It applies when Service deploys AI systems in a professional capacity; AI Act role is Deployer or we provide some AI systems and deploy others; and at least one of: Annex III high-risk areas includes Biometrics; Annex III high-risk areas includes Education and vocational training; Annex III high-risk areas includes Employment and worker management; Annex III high-risk areas includes Essential public services; Annex III high-risk areas includes Creditworthiness; Annex III high-risk areas includes Insurance; Annex III high-risk areas includes Law enforcement; Annex III high-risk areas includes Migration, asylum and border control; Annex III high-risk areas includes Administration of justice and democratic processes; and at least one of: Deployer body type is A body governed by public law or A private entity providing a public service; Annex III high-risk areas includes Creditworthiness; Annex III high-risk areas includes Insurance. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.

When does this become enforceable?

EU AI Act Article 27 — Fundamental rights impact assessment for high-risk AI… is enforceable from 2 August 2026. Its current status is: in force.

What evidence does an auditor expect?

Fundamental rights impact assessment record covering the six elements of Art. 27(1); Notification of the FRIA results to the market surveillance authority (Art. 27(3)); Cross-reference to the GDPR Art. 35 DPIA where one exists (Art. 27(4)).