FRIA facilitation protocol (PR-27-FRIA)

PR-27-FRIA v1.0 is built from ISO/IEC 42005:2025Published and Art. 27 of Regulation (EU) 2024/1689.

Scope

The protocol covers a high-risk AI system referred to in Art. 6(2) at the point where a deployer named in Art. 27(1) prepares its first use. Systems intended for the area of Annex III point 2 are outside the duty and outside the protocol. The deployer's other duties under Art. 26 are covered by PR-14-OVR v1.0 and PR-12-LOG v1.0; the record on Art. 27 lists the split for this article. Under the working reading the duty applies from the Annex III application date 2027-12-02Deferred; the alternative reading is shown under Limitations.

The protocol covers three kinds of element. The five testable elements of the obligation record are checked against an observable result:

• the context of use, against the intended purpose and conditions of use in the instructions for use
• each risk of harm, against its affected group and the provider's information under Art. 13
• the human oversight measures, against the measures in place in the deployment
• the complaint mechanism, with a synthetic test complaint
• each cross-reference to a data protection impact assessment, against the section it cites

The ten documentation elements of the obligation record are assembled into one record whose sections follow the clauses of ISO/IEC 42005:2025Published. The four process elements of the obligation record are recorded as triggers and owners; the protocol does not observe them over the period of use.

The protocol does not decide whether the deployer falls within Art. 27(1) or whether the system is high-risk. It does not decide whether a case is similar enough for reliance under Art. 27(2). Those are classification and legal questions; the protocol records the deployer's determination and the counsel reference behind it. The protocol does not produce bias or accuracy evidence. It integrates the outputs of PR-10-BIAS v1.0 and PR-15-ROB v1.0 where they exist and the provider's declarations under Art. 13(3) otherwise. The protocol does not perform or assess the data protection impact assessment. The limits of the service that uses the protocol are stated on what we cannot do.

Articles covered

Inputs required

Steps

Preparation

1. Record the system name, version and provider identity from the instructions for use.

   Record System identification sheet with name, version and provider identity

   [ISO/IEC 42005:2025 §6.3, AI system information]

2. Record the deployer category claimed under Art. 27(1) and the counsel reference that supports the claim.

   Record Scope record, deployer category and counsel reference

   [Regulation (EU) 2024/1689, Art. 27(1)]

3. Record the deployer's confirmation that the system is not intended for the area of Annex III point 2.

   Record Scope record, Annex III point 2 exception check

   [Regulation (EU) 2024/1689, Art. 27(1)]

4. Set the assessment scope: the deployment sites, the processes, the system versions and the period of use.

   Record Scope record, sites, processes, versions and period

   [ISO/IEC 42005:2025 §5.5, scope of the AI system impact assessment]

5. Collect the instructions for use, the technical documentation and the promotional materials, with version and hash.

   Record Source document register with version and hash per document

   [Regulation (EU) 2024/1689, Art. 27(1)(a)]

6. Collect the data protection impact assessment where one exists, with its section numbering.

   Record Source document register, data protection impact assessment entry with section list

   [Regulation (EU) 2024/1689, Art. 27(4)]

7. Collect the bias and accuracy evidence: PR-10-BIAS v1.0 and PR-15-ROB v1.0 reports, or the provider's Art. 13 declarations.

   Record Evidence register with report identifier and version per item

   [Regulation (EU) 2024/1689, Art. 27(1)(d) and Art. 13(3)(b)]

8. Record whether the deployer relies on a previous assessment or a provider's impact assessment, and why the case is similar.

   Record Reliance record with the assessment relied on and the similarity statement

   [Regulation (EU) 2024/1689, Art. 27(2)]

9. Assign one owner per assessment element and record the assignments.

   Record Responsibility table, one owner role per Art. 27(1) element

   [ISO/IEC 42005:2025 §5.6, allocating responsibilities]

10. Record the deployer's harm likelihood and severity scale with the justification for each level.

    Record Scale justification record with a definition and a justification per level

    [ISO/IEC 42005:2025 §5.7, thresholds for sensitive uses and impact scales]

11. Open the assessment record in the layout below, one section per Art. 27(1) element.

    Record Fundamental rights impact assessment record, sections opened and empty

    [AIAssuranceLabs procedure]

The record layout follows the documentation clauses of ISO/IEC 42005:2025Published and maps each section to the Art. 27(1) element it holds. All values are placeholders.

record: fundamental-rights-impact-assessment
record_version: <version>
approval: { role: <approver role>, status: <draft | approved> }

scope:                                 # ISO/IEC 42005:2025 §6.2
deployer_category: <Art. 27(1) category>
counsel_reference: <memorandum id>
annex_iii_point_2_exception: <not applicable | applicable>
sites: [<site id>]
period_of_use: <period>              # Art. 27(1)(b)
frequency_of_use: <frequency>        # Art. 27(1)(b)

system_information:                    # ISO/IEC 42005:2025 §6.3
name: <system name>
version: <system version>
provider: <provider identity>
instructions_for_use: { id: <doc id>, version: <version>, hash: <sha256> }
technical_documentation: { id: <doc id>, version: <version>, hash: <sha256> }
promotional_materials: [{ id: <capture id>, hash: <sha256> }]

deployment_environment:                # ISO/IEC 42005:2025 §6.6, Art. 27(1)(a)
processes:
  - id: <process id>
    description: <inputs, outputs, decision points>
    context_of_use: <context as used>
    intended_purpose_match: <within | outside>
    source_clause: <instructions for use section>

interested_parties:                    # ISO/IEC 42005:2025 §6.7, Art. 27(1)(c)
affected_groups: [<see affected-groups mapping>]

impacts:                               # ISO/IEC 42005:2025 §6.8, Art. 27(1)(d)
risks_of_harm:
  - id: <risk id>
    group: <group id>
    right: <Charter right>
    art_13_information: <instructions for use section>
    evidence: <PR-10-BIAS or PR-15-ROB report id, or none>
    likelihood: <level on the recorded scale>
    severity: <level on the recorded scale>

measures:                              # ISO/IEC 42005:2025 §6.9, Art. 27(1)(e), (f)
human_oversight:
  - measure: <measure from instructions for use>
    implemented_as: { role: <role>, control: <control>, trigger: <trigger> }
    match: <match | gap>
if_risk_materialises:
  - risk: <risk id>
    measure: <measure>
governance_arrangement: <owner role and route>
complaint_channels:
  - channel: <channel>
    test_complaint_result: <routed | not routed>

dpia_cross_references:                 # Art. 27(4)
- element: <Art. 27(1) point>
  dpia_section: <section number>
  result: <meets | does not meet>

review_triggers:                       # ISO/IEC 42005:2025 §5.12, Art. 27(2)
- <element and the change that triggers an update>

notification:                          # Art. 27(3), Art. 27(5)
template: <AI Office template id, where issued>
status: <prepared | exempt under Art. 46(1)>

Execution

12. Describe each deployer process that uses the system, with its inputs, outputs and decision points.

    Record Process description, one per deployer process

    [ISO/IEC 42005:2025 §6.6, deployment environment]

13. Compare each described context of use with the intended purpose and conditions in the instructions for use.

    Record Context-of-use comparison table, one row per process, result within or outside

    [Regulation (EU) 2024/1689, Art. 27(1)(a)]

14. Record each condition of use stated in the technical documentation or promotional materials that the instructions omit.

    Record Context-of-use comparison table, source column per condition

    [Regulation (EU) 2024/1689, Art. 27(1)(a)]

15. Record the period and the frequency of intended use for each system and each process.

    Record Period and frequency record per system and per process

    [Regulation (EU) 2024/1689, Art. 27(1)(b)]

16. List the categories of natural persons and groups affected in each process.

    Record Affected-groups mapping, category column

    [Regulation (EU) 2024/1689, Art. 27(1)(c); ISO/IEC 42005:2025 §6.7, relevant interested parties]

17. Map each category to the fundamental rights that the use of the system can affect.

    Record Affected-groups mapping, rights column

    [ISO/IEC 42005:2025 §6.8 and Annex C, harms and benefits taxonomy]

18. Record each specific risk of harm against one category and one right in the register.

    Record Risks of harm register, one row per risk with group and right

    [Regulation (EU) 2024/1689, Art. 27(1)(d)]

19. Attach to each risk the accuracy, limitation and residual-risk information from the instructions for use.

    Record Risks of harm register, Art. 13 column with section reference

    [Regulation (EU) 2024/1689, Art. 27(1)(d) and Art. 13(3)(b)]

20. Attach the subgroup performance and robustness results to each risk that concerns a group or performance.

    Record Risks of harm register, evidence column with PR-10-BIAS or PR-15-ROB report reference

    [AIAssuranceLabs procedure]

21. Mark each risk with no provider information under Art. 13 as an open item for the provider.

    Record Open items list, provider entries

    [AIAssuranceLabs procedure]

22. List the human oversight measures set out in the instructions for use.

    Record Oversight measures list, instructions-for-use side

    [Regulation (EU) 2024/1689, Art. 13(3)(d)]

23. Observe each oversight measure in the deployment and record the role, the control and the trigger.

    Record Oversight observation log with role, control and trigger per measure

    [Regulation (EU) 2024/1689, Art. 27(1)(e)]

24. Compare the observed measures with the listed measures and record each gap.

    Record Oversight comparison table, result match or gap per measure

    [Regulation (EU) 2024/1689, Art. 27(1)(e)]

25. Record the measures the deployer takes if each register risk materialises.

    Record Risks of harm register, measures column

    [Regulation (EU) 2024/1689, Art. 27(1)(f); ISO/IEC 42005:2025 §6.9, measures to address harms]

26. Record the internal governance arrangement and each complaint channel, with owner role and route.

    Record Governance and complaint description with owner role and route per channel

    [Regulation (EU) 2024/1689, Art. 27(1)(f)]

27. Submit one synthetic test complaint through each complaint channel named in the description.

    Record Complaint route test record, submission entry per channel

    [AIAssuranceLabs procedure]

28. Record where each test complaint arrives and whether the receiver is the named governance arrangement.

    Record Complaint route test record, result routed or not routed per channel

    [AIAssuranceLabs procedure]

29. Record whether the complaint route feeds a review of the assessment.

    Record Complaint route test record, review link entry

    [ISO/IEC 42005:2025 §5.12, monitoring and review]

30. Follow each cross-reference to the data protection impact assessment and record whether the section meets the cited element.

    Record Data protection impact assessment cross-reference map, result column

    [Regulation (EU) 2024/1689, Art. 27(4)]

The affected-groups mapping produced at steps 16 to 18 uses one row per group and right. All values are placeholders.

group_id | process_id | category of natural persons or group | right affected            | risk_id | art_13_section | evidence
---------|------------|--------------------------------------|---------------------------|---------|----------------|------------------------
<G-01>   | <P-01>     | <category, e.g. applicants>          | <Charter article>         | <R-01>  | <IFU section>  | <PR-10-BIAS report id>
<G-01>   | <P-01>     | <category, e.g. applicants>          | <Charter article>         | <R-02>  | <IFU section>  | <none: open item>
<G-02>   | <P-02>     | <group, e.g. persons with a disability> | <Charter article>      | <R-03>  | <IFU section>  | <PR-15-ROB report id>

columns:
group_id         one identifier per category or group (Art. 27(1)(c); ISO/IEC 42005:2025 §6.7)
right affected   the fundamental right the use of the system can affect (ISO/IEC 42005:2025 §6.8)
risk_id          the register row for the specific risk of harm (Art. 27(1)(d))
art_13_section   the instructions-for-use section with the accuracy, limitation or residual-risk information
evidence         the PR-10-BIAS or PR-15-ROB report that supports the risk, or an open item

Analysis

31. Rate each register risk on the recorded scale and record the basis for each rating.

    Record Risks of harm register, likelihood and severity columns with basis

    [ISO/IEC 42005:2025 §5.9, analysing the results]

32. Mark each check in steps 13, 18, 24, 28 and 30 as met, not met or not verifiable.

    Record Check results table with evidence reference per check

    [AIAssuranceLabs procedure]

33. Record each Art. 27(1) element that a cross-referenced section meets and each element that remains open.

    Record Data protection impact assessment cross-reference map, element coverage per Art. 27(1) point

    [Regulation (EU) 2024/1689, Art. 27(4)]

34. Record the review triggers: each change to an element that requires an update of the assessment.

    Record Review trigger list, one trigger per element

    [Regulation (EU) 2024/1689, Art. 27(2); ISO/IEC 42005:2025 §5.12, monitoring and review]

35. Check that the record holds the six elements and one owner per element.

    Record Completeness check, six elements and one owner per element

    [Regulation (EU) 2024/1689, Art. 27(1)]

Reporting

36. Assemble the assessment record with the six elements, the register, the mapping and the evidence references.

    Record Fundamental rights impact assessment record, assembled

    [ISO/IEC 42005:2025 §5.10, recording and reporting]

37. Record the deployer's approval of the record with the approver's role and the record version.

    Record Approval entry with approver role and record version

    [ISO/IEC 42005:2025 §5.11, approval process]

38. Fill the notification checklist against the AI Office template where the template is issued.

    Record Market surveillance authority notification checklist

    [Regulation (EU) 2024/1689, Art. 27(3) and Art. 27(5)]

39. Record the Art. 46(1) basis where the deployer claims exemption from the notification.

    Record Notification checklist, exemption entry with the Art. 46(1) basis

    [Regulation (EU) 2024/1689, Art. 27(3)]

40. Version the record and list the open items for the provider and for the deployer.

    Record Versioned record and open items list for provider and deployer

    [AIAssuranceLabs procedure]

Thresholds and criteria

Regulation (EU) 2024/1689 sets no numeric threshold for Art. 27: no likelihood, severity or acceptance value is given for a risk of harm. The pass criterion for each check is a consistency criterion taken from the text of the article. The risk rating uses a scale the deployer sets and justifies.

The source of each criterion follows the hierarchy stated on the Art. 27 obligation page. No harmonised standard covers the fundamental rights impact assessment. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity exists. No JTC 21 draft in the standards tracker addresses Art. 27. The level in use is an ISO/IEC standard. ISO/IEC 42005:2025Published supplies the process and the structure of the record. Its clause §5.7 places the setting of thresholds and impact scales with the organisation. It sets no acceptance value. The deployer sets its own likelihood and severity scale and justifies each level against the context of use and the affected groups. Step 10 records that justification and step 31 applies the scale. A check marked "not verifiable" at step 32 states what evidence was missing.

Outputs

The sample forms of each deliverable are on deliverables.

Limitations

The protocol cannot show that the deployer is within Art. 27(1) or that the system is high-risk under Art. 6(2). It cannot show that a case is similar for reliance under Art. 27(2). It records the deployer's determination and the counsel reference. The protocol cannot show that the assessment was performed before the first use of the system. The approval entry carries the record version; the timing of first use is a process element the deployer evidences.

The protocol cannot show that the list of affected groups is complete. Identification of interested parties under ISO/IEC 42005:2025Published depends on the deployer's knowledge of its processes and on consultation the protocol does not perform. The protocol cannot show that the deployer's likelihood and severity scale is adequate; no published threshold exists, and step 10 records the deployer's justification only.

The test complaint at steps 27 and 28 shows that a channel accepts a complaint and routes it to the named arrangement. It does not show how complaints are handled over the period of use. The cross-reference check at step 30 shows that a cited section holds the content of the element it is cited for. It does not assess the data protection impact assessment against its own legal basis. Where no PR-10-BIAS v1.0 or PR-15-ROB v1.0 report exists and the instructions for use carry no Art. 13 information, the risks of harm stay open items. The protocol does not produce that evidence.

Where the AI Office template under Art. 27(5) is not yet issued, the notification checklist follows the Art. 27(1) elements and the content of Art. 27(3). The record then lists a re-run of step 38 as a review trigger.

Sources

• ISO/IEC 42005:2025Published: AI system impact assessment, ISO/IEC JTC 1/SC 42. Clauses §5.5 to §5.12 give the assessment process; clauses §6.2 to §6.9 give the documentation; Annex C gives the harms and benefits taxonomy.
• Regulation (EU) 2024/1689, consolidated text on EUR-Lex: Art. 6(2), Art. 13(3), Art. 26, Art. 27, Art. 46(1), Annex III.
• Standards tracker: stage of every standard named on this page, from data.

Revision history

The initial version is listed below; each later version records its change and the regulation entry that dates it.