Art. 27: Fundamental rights impact assessment under the EU AI Act

Art. 27 requires the deployers it names to assess the impact on fundamental rights before the first use of a high-risk AI system referred to in Art. 6(2). The deployer notifies the market surveillance authority of the results. In this mapping, five elements are testable, ten are documentation and four are process. Regulation (EU) 2026/1744 moved the application date and added the cross-reference option in Art. 27(4) and (5). The working reading places the assessment with the Annex III package 2027-12-02Working reading; the alternative reading is in the Unsettled callout below.

Where this applies

2027-12-02Working readingArticle 27 FRIA applicability date
2027-12-02DeferredAnnex III standalone high-risk obligations

What the text requires

The duty falls on the deployer, next to the deployer's duties under Art. 26. Art. 27(1)(d) draws on the accuracy, limitation and residual-risk information the provider supplies under Art. 13, and Art. 27(1)(e) describes how the oversight measures the provider designs under Art. 14 are implemented in the deployment. Art. 27(4) links the assessment to the data protection impact assessment under Art. 35 of Regulation (EU) 2016/679, which the fundamental rights impact assessment complements.

What the text requires and how each element is verified
Requires	Testable	Documentation	Process
Art. 27(1)Deployers that are bodies governed by public law, private entities that provide public services, and deployers of the high-risk AI systems in Annex III points 5(b) and (c) perform an assessment of the impact on fundamental rights that the use of a high-risk AI system referred to in Art. 6(2) may produce. The duty applies before the deployer deploys the system. Systems intended for use in the area of Annex III point 2 are excepted. The assessment consists of the elements in points (a) to (f). Art. 27(1)(a)The assessment describes the deployer's processes in which the high-risk AI system is used in line with its intended purpose. The description includes the specific context and conditions of use as specified in the information supplied by the provider in the instructions for use, in promotional or sales materials and statements, and in the technical documentation. Art. 27(1)(b)The assessment describes the period of time within which, and the frequency with which, each high-risk AI system is intended to be used. Art. 27(1)(c)The assessment identifies the categories of natural persons and groups likely to be affected by the use of the system in the specific context. Art. 27(1)(d)The assessment identifies the specific risks of harm likely to have an impact on the categories of natural persons or groups identified under point (c). The deployer takes into account the information given by the provider under Art. 13. Art. 27(1)(e)The assessment describes the implementation of human oversight measures according to the instructions for use. Art. 27(1)(f)The assessment states the measures to be taken if the risks materialise. The measures include the arrangements for internal governance and complaint mechanisms. Art. 27(2)The duty in Art. 27(1) applies to the first use of the high-risk AI system. In similar cases, the deployer may rely on a fundamental rights impact assessment conducted previously or on an existing impact assessment carried out by the provider. If during use the deployer considers that an element listed in Art. 27(1) has changed or is no longer up to date, the deployer takes the necessary steps to update the information. Art. 27(3)Once the assessment is performed, the deployer notifies the market surveillance authority of its results. The deployer submits the filled-out template referred to in Art. 27(5) as part of the notification. In the case referred to in Art. 46(1), the deployer may be exempt from the duty to notify. Art. 27(4)Where an obligation in Art. 27 is already met through a data protection impact assessment under Art. 35 of Regulation (EU) 2016/679 or Art. 27 of Directive (EU) 2016/680, the deployer may include cross-references to the relevant sections of that data protection impact assessment, or include the relevant parts of it, in the fundamental rights impact assessment. The fundamental rights impact assessment complements the data protection impact assessment. Regulation (EU) 2026/1744 added the cross-reference and inclusion option. Art. 27(5)The AI Office develops a template for a questionnaire, including through an automated tool, so that deployers can meet their duties under Art. 27 in a simplified manner. Where relevant, the template gives deployers the possibility to include cross-references to the relevant sections of the data protection impact assessment, or to include the relevant parts of it, under Art. 27(4). Regulation (EU) 2026/1744 added the cross-reference provision to the template.	The context and conditions of use described under Art. 27(1)(a) fall within the intended purpose and the conditions of use stated in the provider's instructions for use and technical documentation Each risk of harm listed under Art. 27(1)(d) is tied to a category of persons or a group identified under Art. 27(1)(c) and to the accuracy, limitation and residual-risk information the provider supplies under Art. 13 The human oversight measures described under Art. 27(1)(e) are the measures in place in the deployment and match the measures set out in the instructions for use The complaint mechanism described under Art. 27(1)(f) accepts a test complaint and routes it to the internal governance arrangement named in the assessment Each cross-reference to a data protection impact assessment under Art. 27(4) resolves to a section that meets the Art. 27(1) element it is cited for	A fundamental rights impact assessment record exists before the first use of the system and holds the six elements of Art. 27(1)(a) to (f) A description of the deployer's processes in which the system is used, with the specific context and conditions of use drawn from the instructions for use, promotional or sales materials and the technical documentation (Art. 27(1)(a)) A description of the period of time and the frequency of intended use for each high-risk AI system (Art. 27(1)(b)) A list of the categories of natural persons and groups likely to be affected in the specific context (Art. 27(1)(c)) A register of the specific risks of harm per affected category, with the Art. 13 information taken into account recorded (Art. 27(1)(d)) A description of the implementation of human oversight measures according to the instructions for use (Art. 27(1)(e)) A description of the measures to be taken if the risks materialise, including internal governance arrangements and the complaint mechanism (Art. 27(1)(f)) Where the deployer relies on a previous fundamental rights impact assessment or a provider's impact assessment in a similar case, a record of that reliance and of why the case is similar (Art. 27(2)) A notification record to the market surveillance authority with the filled-out AI Office template, or a record of the Art. 46(1) basis for exemption from notification (Art. 27(3), Art. 27(5)) A cross-reference map from each Art. 27(1) element met through a data protection impact assessment to the section or the included part of that assessment (Art. 27(4))	The assessment is performed before the first use of the high-risk AI system (Art. 27(1), Art. 27(2)) During use, the deployer reviews whether any Art. 27(1) element has changed or is no longer up to date and updates the information when it has (Art. 27(2)) The internal governance arrangement and the complaint mechanism named under Art. 27(1)(f) operate for the period of use and feed changes back into the assessment The notification to the market surveillance authority follows each performed assessment (Art. 27(3))

Metrics and where thresholds come from

Threshold sources, in order of precedence

A harmonised standard cited in the Official Journal (none as of the anchor date)
A JTC 21 draft standard (prEN), with its stage
An ISO/IEC standard or technical report, with its stage
A Commission guideline or code of practice, with its date from the standards data
NIST AI RMF or a sector framework
The state of the art, which the provider justifies and documents

Regulation (EU) 2024/1689 sets no numeric threshold for Art. 27: no likelihood, severity or acceptance value is given for a risk of harm. No harmonised standard covers the fundamental rights impact assessment, and no harmonised standard is cited in the Official Journal as of the anchor date. The hierarchy level in use today is an ISO/IEC standard: ISO/IEC 42005:2025 (published) supplies the process and the structure of the record but sets no acceptance value. The deployer sets its own harm likelihood and severity scale, justifies it against the context of use and the affected groups, and documents it; the scale-justification step of PR-27-FRIA records that justification.

Metric sources and their stage
Source and stage	Title	What it provides here	Verified on
`ISO/IEC 42005:2025`Published	AI system impact assessment	impact assessment process and record structure: system scope and context of use, affected individuals and groups, potential harms and benefits, mitigations and review triggers, which map onto the Art. 27(1)(a) to (f) elements and the Art. 27(2) update duty	Verified on 18 September 2026ISO catalogue, ISO/IEC 42005:2025

Procedures

Each protocol is versioned; its page states the derivation from the standards above. PR-27-FRIA v1.0 covers the five testable elements, from the context-of-use check against the instructions for use to the data protection impact assessment cross-reference check.

PR-27-FRIA v1.0FRIA facilitation protocolv1.0

What an assessor asks for

Fundamental rights impact assessment record (PR-27-FRIA output)
Deployment process and context-of-use description (Art. 27(1)(a))
Affected persons and groups mapping (Art. 27(1)(c))
Risks of harm register with Art. 13 information cross-referenced (Art. 27(1)(d))
Human oversight implementation description (Art. 27(1)(e))
Internal governance and complaint mechanism description (Art. 27(1)(f))
Market surveillance authority notification record with the filled-out template (Art. 27(3))
Data protection impact assessment cross-reference map (Art. 27(4))

Common findings

The context of use is described from the deployer's own process alone, without reference to the intended purpose and the conditions of use in the instructions for use
Affected persons are listed as one category, so no risk of harm is tied to a specific group
Risks of harm are stated without the accuracy, limitation and residual-risk information the provider supplies under Art. 13
Human oversight is described as an organisational role, not as the measures set out in the instructions for use
The complaint mechanism is named but no route from a complaint to a review of the assessment is recorded
A data protection impact assessment is attached in full instead of cross-referenced per Art. 27(1) element, so the elements the fundamental rights impact assessment has to complement are not visible

Questions

What does the Article 27 fundamental rights impact assessment contain?

Art. 27(1) lists six elements. Point (a) describes the deployer's processes and the context and conditions of use. Point (b) gives the period and frequency of use. Point (c) lists the categories of natural persons and groups likely to be affected. Point (d) lists the specific risks of harm to those categories, taking the Art. 13 information into account. Point (e) describes the implementation of human oversight measures according to the instructions for use. Point (f) states the measures to be taken if the risks materialise, including internal governance and complaint mechanisms. ISO/IEC 42005:2025 (published) gives a record structure that these six elements map onto.

Who performs the Article 27 fundamental rights impact assessment for high-risk AI systems?

Art. 27(1) places the duty on three kinds of deployer. The first is a deployer that is a body governed by public law. The second is a private entity that provides public services. The third is a deployer of a high-risk AI system in Annex III point 5(b) or (c). The duty covers high-risk AI systems referred to in Art. 6(2). Systems intended for the area in Annex III point 2 are excepted. The provider of the system has no duty under Art. 27, but Art. 27(2) lets the deployer rely on an existing impact assessment carried out by the provider in a similar case.

How is the EU AI Act fundamental rights impact assessment explained as testable and documentary elements?

Most of Art. 27 is met by a record. The six descriptions in Art. 27(1)(a) to (f), the notification under Art. 27(3) and the cross-reference map under Art. 27(4) are documentation. Two duties are process: the assessment happens before first use, and it is updated when an element changes under Art. 27(2). Five elements have an observable result. The described context of use is checked against the instructions for use. Each risk of harm is checked against the affected group and the Art. 13 information. The described oversight measures are checked against the measures in place. The complaint mechanism is checked with a test complaint. Each DPIA cross-reference is checked against the section it cites. PR-27-FRIA covers these checks.

How do the FRIA and the DPIA relate under Article 27?

Art. 27(4) links the two assessments. Where an Art. 27 obligation is already met through a data protection impact assessment under Art. 35 of Regulation (EU) 2016/679 or Art. 27 of Directive (EU) 2016/680, the deployer may cross-reference the relevant sections of that assessment or include the relevant parts. The fundamental rights impact assessment complements the data protection impact assessment. Regulation (EU) 2026/1744 added the cross-reference and inclusion option. Art. 27(5) requires the AI Office template to allow the same cross-references. A data protection impact assessment on its own does not meet Art. 27, because the elements in Art. 27(1)(c) to (f) reach beyond personal data.

What is the difference between a FRIA and a DPIA?

A DPIA is required by Art. 35 of Regulation (EU) 2016/679 and covers risks to the rights and freedoms of natural persons from the processing of personal data. A FRIA is required by Art. 27 of Regulation (EU) 2024/1689 and covers the impact on fundamental rights from the use of a high-risk AI system. The DPIA duty falls on a controller. The FRIA duty falls on the deployers named in Art. 27(1). The FRIA adds elements a DPIA does not hold: the affected groups in the specific context under Art. 27(1)(c), the human oversight implementation under Art. 27(1)(e), and the complaint mechanism under Art. 27(1)(f). Art. 27(3) adds a notification to the market surveillance authority. Under Art. 27(4) the FRIA complements the DPIA and may cross-reference it.

How we test this

We test the assessment record against Art. 27(1)(a) to (f): the context of use against the instructions for use, each risk of harm against its affected group and the Art. 13 information, the oversight measures against the deployment, the complaint mechanism with a test complaint, and each data protection impact assessment cross-reference against the section it cites. We prepare the evidence a market surveillance authority asks for under Art. 27(3); the scope limits are stated on what we cannot do.

FRIA facilitation and evidence structuringPR-27-FRIA

What we cannot do

We do not perform conformity assessments where a notified body is required.
We do not issue CE marking or the EU Declaration of Conformity.
We are not a notified body.
We do not give legal opinions on classification or liability.
We test against requirements, prepare evidence, and structure documentation; compliance decisions remain with the provider or deployer, their notified body, and their counsel.

Read the full statement