Fundamental Rights Impact Assessment (FRIA)
A Fundamental Rights Impact Assessment (FRIA) is the structured analysis required by Article 27 of the EU AI Act for certain deployers of high-risk AI systems — bodies governed by public law, private entities providing public services, and deployers of credit-scoring AI or of life- and health-insurance risk-assessment and pricing AI (Annex III points 5(b) and 5(c)).
AIDOLS Research Team · Editorial standards
Full definition
Required content includes: (1) processes in which the system will be used; (2) period and frequency of use; (3) categories of natural persons likely affected; (4) specific risks of harm; (5) human-oversight measures; (6) mitigations if risks materialize. The assessment must be notified to the relevant market-surveillance authority. FRIA is distinct from — and complementary to — GDPR Data Protection Impact Assessment (DPIA); the AI Act allows the two to be combined.
Why it matters
FRIA puts deployers (not just providers) on the hook for high-risk AI governance. For public-sector buyers and regulated industries, FRIA is now a mandatory step in any procurement of high-risk AI — and a recurring compliance cost.
Example
A municipality deploys an AI tool to triage social-benefits applications (Annex III §5); before go-live it runs a FRIA covering language access, appeal rights, and disparate-impact monitoring, and registers the assessment with the national authority.
Next steps
Related terms
- EU AI ActThe EU AI Act (Regulation (EU) 2024/1689) is the European Union's comprehensive, risk-tiered regulation of AI systems, the world's first horizontal AI law, with obligations phasing in from February 2025: general-purpose AI model rules from 2 August 2025 (Commission fines from 2 August 2026; models already on the market have until 2 August 2027) and, after the Digital Omnibus (Regulation (EU) 2026/1744), high-risk rules from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- EU AI Act Risk TierEU AI Act risk tiers are the four-level classification — unacceptable, high, limited, and minimal/no risk — that determines which obligations apply to an AI system placed on the EU market under Regulation (EU) 2024/1689.
- AI Act Conformity AssessmentA conformity assessment under the EU AI Act is the procedure by which a high-risk AI system is verified to meet the regulation's requirements (Articles 8–15) before being placed on the EU market or put into service.
- AI Risk AssessmentAn AI risk assessment is a structured review of an AI system's potential harms — to individuals, groups, the organization, and society — covering likelihood, severity, affected populations, and mitigation controls across safety, fairness, security, privacy, and compliance dimensions.
More governance & risk terms
- Data ResidencyData residency is the requirement — imposed by law, regulation, contract, or policy — that data be stored, processed, or accessed only within specified geographic or jurisdictional boundaries.
- AI BiasAI bias is systematic, unfair difference in an AI system's outputs across demographic, geographic, or other groups — usually caused by biased training data, biased labels, or biased problem framing rather than the algorithm itself.
- Explainability (XAI)Explainability (XAI) is the property of an AI system whose decisions can be understood by humans — through model-level documentation, prediction-level attributions, and counterfactual explanations — and a regulatory expectation in finance, healthcare, hiring, and other high-stakes domains.
Source & further reading
Primary source: European Union — Regulation (EU) 2024/1689, Article 27 (2024).
Citation policy: this entry is part of the AIDOLS AI Implementation Glossary and may be quoted for research, journalism, and education with attribution to aidolsgroup.com/en/glossary/fundamental-rights-impact-assessment/.