FRIA Template for Annex III, 4 (Employment AI)

Main article: FRIA Art. 27 (glossary) — the glossary definition of the fundamental rights impact assessment under Art. 27 AI Act.

Obligation or practice template? How to classify this template

The seven fields below follow the mandatory content of the FRIA under Art. 27 AI Act; for Annex III, 4 the obligation itself applies exclusively to deployers that are bodies governed by public law or that, as private entities, provide public services — irrespective of their public or private status, the only other deployers covered are those under Annex III no. 5 (b)/(c) (creditworthiness, health/life insurance). The completion notes in the fields are practice recommendations where they do not cite a provision; where there is a risk of confusion with a statutory deadline — for instance the quarterly cycle in field 7 — this is expressly flagged. If you are not covered, you can use the grid as a documentation aid — it then structures the evidence for the deployer obligations under Art. 26 and for national discrimination liability, not an obligation under Art. 27. Check your public or private status and the Annex III number first (field 1) — that determines whether the following seven fields document an obligation or a voluntary evidence structure.

On timing: the FRIA obligation under Art. 27 belongs to Chapter III, Section 3 and applies to Annex III systems from 2 December 2027. The basis is Regulation (EU) 2026/1744 (Digital Omnibus AI) of 8 July 2026, in force since 27 July 2026: it postpones the high-risk obligations of Chapter III, Sections 1 to 3 to 2 December 2027 for Annex III systems and to 2 August 2028 for Annex I systems. The general date of application of the AI Act on 2 August 2026 remains unchanged. Fixed calendar dates are therefore decisive (Art. 113(3) AI Act in the version applicable since 27 July 2026); the references are set out in the sources section.

The following table lists obligations under the AI Act only; the middle column reflects the addressees determined by the provision cited in each case.

Which HR systems fall under Annex III no. 4?

Evaluative systems are covered, informational ones are not. Annex III no. 4 AI Act covers the area of 'employment, workers management and access to self-employment': Annex III no. 4(a) covers AI for the recruitment or selection of natural persons (for instance targeted job advertisements, CV match scoring, analysing and filtering applications, evaluating candidates), no. 4(b) covers AI for decisions affecting terms of work-related relationships, promotion or termination, for allocating tasks based on individual behaviour or personal traits, and for monitoring and evaluating the performance and behaviour of employees (for instance performance scoring, workforce planning with promotion or dismissal recommendations, monitoring of employees). Purely informational systems such as an HR FAQ chatbot or an appointment booking bot for applicants do not fall under it — in the case of the booking bot via the narrowly construed exception in Art. 6(3) (specific, narrowly defined task). If the system produces recommendations or evaluations capable of materially influencing human decisions, it remains high-risk AI.

1. Description of the deployment

In field 1 you describe which system you use, in which role and for what purpose. Which use case (recruitment, performance evaluation, etc.), provider, model version, frequency of use.

Add four pieces of information to this field that will carry every further line of the FRIA. First, the role: provider under Art. 3 no. 3 or deployer under Art. 3 no. 4 — where the purpose or functionality is substantially modified, or where the system is placed on the market under its own name, a deployer becomes a provider under Art. 25 and then bears risk management (Art. 9), technical documentation under Annex IV (Art. 11), conformity assessment (Art. 43) and registration in the EU database (Art. 49). Second, the Annex III number including the letter (no. 4(a) or 4(b)). Third, the result of the assessment under Art. 6(3) with reasons why the exception does or does not apply. Fourth, the delineation from the prohibited practices: emotion recognition in the workplace is prohibited under Art. 5(1)(f), and the prohibition has applied since 2 February 2025. Therefore record expressly which functions of the system you have examined and ruled out.

2. Period of use + frequency

In field 2 you record over what period and how often the system runs. Pilot vs. production, estimated use cases per month, expected lifetime.

The documented period determines which evidence you will later be able to produce. Art. 26(6) requires the deployer to keep the automatically generated logs for at least six months — an assessment period reaching further back than the configured log retention cannot be evidenced after the fact. Practice recommendation: tie log retention at least to the period documented in the FRIA and record the configured duration in this field; the minimum of six months is statutory, any longer period is a decision of your own organisation. Keep the pilot and production phases separate: period and frequency form one of the elements listed in Art. 27(1), and a change to them triggers the obligation to update under Art. 27(2). Therefore also record the case volume per month from which you will schedule a fresh assessment.

3. Categories of affected persons

In field 3 you record which groups of people the system evaluates and how many there are per year. Applicants, employees, line managers. Number per year. Identify vulnerable groups (people with severe disabilities, pregnant employees, older employees).

The categories of persons determine which grounds of discrimination can arise at all — this field is therefore the bridge to field 4. In Germany, § 1 AGG lists the protected grounds: race or ethnic origin, gender, religion or belief, disability, age and sexual identity. In Austria, § 3 GlBG (gender) and § 17 GlBG (ethnic affiliation, religion or belief, age, sexual orientation) prohibit discrimination in connection with an employment relationship. Also note whether special categories under Art. 9 GDPR are processed — health data, ethnic origin, trade union membership and biometric data are subject to a general prohibition on processing with narrow exceptions. A hard limit applies to vulnerable groups: under Art. 5(1)(b), exploiting vulnerabilities due to age, disability or a social or economic situation is prohibited.

4. Specific risks to fundamental rights

In field 4 you assess, for each fundamental right, which risk the use triggers and how serious the harm is. CFR Art. 21 (discrimination), Art. 8 (data protection), Art. 31 (fair working conditions). For each risk: likelihood of occurrence + severity of harm.

Make the Charter articles tangible through the relevant national provisions, otherwise the risk line cannot be assessed. A distinction must be drawn between direct discrimination (less favourable treatment on a protected ground) and indirect discrimination (apparently neutral provisions capable of putting persons at a particular disadvantage) — in Germany § 3(1) to (4) AGG, in Austria § 5 and § 6 and § 19 GlBG, which there also cover harassment and the instruction to discriminate as separate categories. Accordingly, describe a match score that attaches to an apparently neutral characteristic and is capable of putting bearers of a protected characteristic at a particular disadvantage as a case of indirect discrimination — not as 'model inaccuracy'.

The severity of harm can be quantified: in Germany the employer owes compensation for the damage under § 15(1) and (2) AGG — provided it is responsible for the breach of duty — and appropriate monetary compensation; in the case of non-recruitment this is capped at three months' salary where the person would not have been recruited even under a non-discriminatory selection. In Austria, § 12 and § 26 GlBG provide for statutory minimum and maximum amounts: at least two months' pay where the position would have been obtained under a non-discriminatory selection, no more than EUR 500 where the harm consists solely in the application not being considered, and at least EUR 1,000 for sexual or gender-related harassment (§ 12(11) GlBG) and for harassment under § 26(11) GlBG. The rules of evidence decisive for enforcement differ between Germany and Austria — see the DE/AT section below. You fill in the line on Art. 31 CFR (fair working conditions) above all for systems under Annex III no. 4(b) (monitoring of employees): record there the scope and duration of the monitoring and how employees are informed under Art. 26(7). You fill in the line on Art. 8 CFR (protection of personal data) from the data types recorded in field 3: record whether special categories under Art. 9 GDPR are processed, which data subject rights under Art. 15 to 22 GDPR are triggered (for the response deadline see field 6) and whether a data protection impact assessment under Art. 35 GDPR is running for the same processing — in which case refer to it here instead of repeating it. Practice recommendation: the grading of likelihood of occurrence is an internal decision. Derive it in a comprehensible way from the case volume per month documented in field 2 and the number of affected persons from field 3, and record the grading used in writing.

5. Human oversight measures

In field 5 you document by name who reviews which output, with what powers of intervention and with what level of training. Who reviews every output? What powers of intervention? Level of training of the reviewers? Escalation mechanism.

Answer the four questions by name and with powers, not with job titles. Human oversight (Art. 14) is one of the requirements the Annex III regime places on high-risk AI — what the provision requires in detail is dealt with in the glossary entry 'Human Oversight Art. 14' (linked below under 'Related articles'); on the deployer side, the check of the relevance of the input data (Art. 26(4)) and log retention (Art. 26(6)) are added. Practice recommendation: use both as evidence that oversight actually took place. You determine what powers of intervention the individual reviewer has — they belong on the same line as the reviewer's name, otherwise it remains open what the oversight can achieve if it matters. The level of training has its own legal basis: AI literacy under Art. 4 has applied since 2 February 2025; under it, providers and deployers take measures to support the AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf — Art. 4(1), as applicable since 27 July 2026, does not require any specific level of AI literacy. In practice, typical training content covers the definition of AI, risk classes, prohibited practices, transparency obligations and human oversight. Practice recommendation: document the date and scope of the training for each reviewer. You determine the stages of the escalation path yourself — who decides where the score and the reviewer's judgement conflict, who stops operation; mark them expressly in the FRIA as a practice recommendation of your own organisation.

6. Risk mitigation measures

In field 6 you list the measures with which you reduce the risks from field 4. Bias tests + frequency, anonymised initial selection, complaints mechanism, transparency for applicants.

Two of the four measures named have a direct legal anchor — the complaints mechanism and transparency. Complaints mechanism: in Germany, employees have the right under § 13(1) AGG to complain to the competent body of the establishment; the complaint must be examined and the result communicated, and under § 12(5) AGG the Act and the competent body must be made known within the establishment. In Austria, the Ombud for Equal Treatment (GAW) advises and supports persons who feel discriminated against (§ 3 GBK/GAW Act). Organisational duty: in Germany, § 12(1) to (3) AGG requires the necessary measures, including preventive ones; appropriate training of employees counts as fulfilment of this duty. Transparency: employees must be informed under Art. 26(7). Where the system interacts directly with applicants, providers must ensure under Art. 50(1) that the person is informed that they are interacting with an AI system — check whether the tool you have purchased actually displays this notice. Requests from data subjects under Art. 15 to 22 GDPR must be responded to under Art. 12(3) GDPR without undue delay and at the latest within one month; the deadline can be extended by two months in complex cases. The job advertisement already belongs here: § 11 AGG in Germany; in Austria, § 9 GlBG requires gender-neutral job advertisements — an employer that advertises a position for men only or women only receives a formal caution for a first breach and is fined up to EUR 360 only for further breaches (§ 10(3) GlBG). Practice recommendation: for the bias test, record which grounds are tested against — in Germany the grounds in § 1 AGG, in Austria those in § 3 and § 17 GlBG — and whether the test targets direct or indirect discrimination (field 4). For the anonymised initial selection, note which characteristics are removed and which proxy characteristics nevertheless remain in the score; these are precisely the starting point for indirect discrimination. You determine the frequency, test procedure and date of performance yourself; record them in writing so that the measure remains verifiable.

7. Re-evaluation

In field 7 you set the cycle and the triggers for a fresh assessment. Quarterly re-evaluation. In the case of substantial modifications to the model / intended purpose: new FRIA.

The quarterly cycle is a practice recommendation, not a statutory deadline. The statutory trigger is set out in Art. 27(2): the FRIA must be updated as soon as one of the elements listed in Art. 27(1) has changed or is no longer up to date. Therefore, alongside the date, also define the triggers: new model version, changed intended purpose, new category of persons, changed case volume, new provider. In the case of a substantial modification of the purpose or functionality, Art. 25 applies in addition — you are then a provider and owe the provider obligations named in field 1. Record in this field who monitors the triggers and where the result goes; the addressee is the notification of the market surveillance authority under Art. 27(3) and (5).

After the FRIA: update, notify, retain

After the first version, three statutorily anchored steps follow — plus a gap you have to close yourself. Update: Art. 27(2) (see field 7). Notify: under Art. 27(3) and (5) the results must be notified to the market surveillance authority, using the questionnaire template of the EU AI Office. Which authority that is, is determined by the Member States: under Art. 70, each Member State designates at least one market surveillance authority, including one as a single point of contact, whose contact details had to be made publicly available by 2 August 2025. Retain: the six-month minimum under Art. 26(6) applies to the logs, and the ten-year period under Art. 18(1) applies to the provider documentation.

The gap: Art. 27 AI Act sets no retention period for the FRIA itself. The widespread rule of thumb 'for as long as the AI is used + 5 years afterwards' is a practice recommendation without a statutory basis — use it if you wish, but record it as a decision of your own organisation and not as a deadline under the AI Act.

FRIA and DPIA: separate bases, shared data basis

The FRIA and the data protection impact assessment are two assessments with different points of reference. Art. 35(1) GDPR attaches to the processing: where a type of processing — in particular using new technologies — is likely to result in a high risk to the rights and freedoms of natural persons, a DPIA must be carried out beforehand; under Art. 35(3) GDPR it is required in particular for a systematic and extensive evaluation of personal aspects producing legal effects, and for processing on a large scale of special categories of data. Art. 27 AI Act, by contrast, attaches to the operation of a high-risk AI system by certain deployers.

In practice the content overlaps considerably: you gather the categories of data subjects, data types, risks and protective measures once and use them in both documents — you carry out the assessment separately and on the respective legal basis. Bear in mind the obligation to designate a data protection officer: in Germany, under § 38(1) of the German Federal Data Protection Act (BDSG) — in addition to Art. 37(1)(b) and (c) GDPR — a data protection officer must be designated where at least 20 persons are constantly engaged in the automated processing of personal data, and irrespective of the number of persons where processing operations are subject to a data protection impact assessment under Art. 35 GDPR. Austria provides no numerical threshold going beyond Art. 37 GDPR; there, the obligation follows directly from Art. 37 GDPR.

Germany and Austria: identical AI Act, different discrimination liability

The AI Act applies in the same way in both countries — the differences lie in discrimination law. As a directly applicable EU regulation, Annex III, the exception in Art. 6(3), the provider and deployer obligations (Art. 9, 11, 26, 27, 43, 49) and the deadlines apply in Austria identically to Germany; only the competent authorities (Art. 70) and the penalty regime within the framework of Art. 99(1) are governed nationally. The template above is therefore transferable without rebuilding the statutory references. Liability in the HR case is different: in Austria it does not run via the AGG but via the Equal Treatment Act (GlBG).

For the FRIA this means: field 4 (fundamental rights risks) and field 6 (risk mitigation) must be filled in separately for each jurisdiction if you employ people in both countries. In Austria, the competent bodies are the Ombud for Equal Treatment, the Equal Treatment Commission (Gleichbehandlungskommission) and the labour and social courts — not the Federal Anti-Discrimination Agency.