FRIA (Fundamental Rights Impact Assessment)
Fundamental rights impact assessment under Art. 27 EU AI Act
TL;DR
A fundamental rights impact assessment (FRIA) is mandatory under Art. 27 EU AI Act for deployers of high-risk AI systems in: public bodies, private entities performing public tasks, and Annex III no. 5(b) (credit scoring) and no. 5(c) (life and health insurance scoring). Content: description of the AI use, the persons affected, risks to fundamental rights, and safeguards.
What is a FRIA (Fundamental Rights Impact Assessment)?
The FRIA under Art. 27 is NOT the DPIA under Art. 35 GDPR — but the FRIA complements a DPIA that has already been carried out (Art. 27(4) AI Act).
Deployers subject to the obligation:
- Public bodies of every kind
- Private bodies performing public tasks
- Annex III no. 5(b): creditworthiness assessment (banks, credit scoring providers)
- Annex III no. 5(c): life and health insurance scoring
Date of application: 2 December 2027 for Annex III systems — Art. 27 forms part of Chapter III Section 3 (Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026).
Notification obligation: the result of the FRIA must be notified to the market surveillance authority (Art. 27(3)).
Territorial scope Germany/Austria: Art. 27 forms part of the directly applicable EU AI Act (Regulation (EU) 2024/1689). The FRIA obligation applies equally in Germany and Austria — the text of the Regulation applies word for word in both Member States; there are no divergent national provisions.
Practical example
A practical example: a savings bank deploys AI-based credit scoring.
- Description: a model for assessing the creditworthiness of private customers
- Persons affected: applicants (private customers)
- Fundamental rights risks: discrimination (gender, origin), informational self-determination, the right to an explanation
- Safeguards: bias testing, a final human decision, an explainability module, a complaints channel
- Notification to BaFin (sectoral supervision) plus market surveillance