FRIA vs DPIA: which assessment a deployer owes
A deployer of a high-risk AI system holds a data protection impact assessment under Art. 35 of Regulation (EU) 2016/679 and asks whether Art. 27 of Regulation (EU) 2024/1689 adds a second assessment. Art. 27 adds a second assessment for the deployers named in Art. 27(1): the fundamental rights impact assessment complements the DPIA and may cross-reference the DPIA under Art. 27(4). Under the working reading the duty follows the Annex III application date Deferred. This page compares the two instruments, gives the sequence, and names the evidence.
Where this starts
The organisation bought or licensed a high-risk system, for example a credit model or a benefits-eligibility tool, and uses it in its own decisions. The data protection officer ran a DPIA when the processing started, because Art. 35(3)(a) of Regulation (EU) 2016/679 names a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, with legal or similarly significant effects. The business owner now reads Art. 27 and finds a second assessment under a different instrument, with a different addressee. The deployer hub lists the full obligation set; this page sets out the relation between the two records.
The two duties fall on two roles defined in two regulations. The DPIA duty under Art. 35(1) of Regulation (EU) 2016/679 falls on the controller, before the processing, where the processing is likely to result in a high risk to the rights and freedoms of natural persons. The FRIA duty under Art. 27(1) of Regulation (EU) 2024/1689 falls on three kinds of deployer of a high-risk AI system referred to in Art. 6(2): a body governed by public law, a private entity that provides public services, and a deployer of a creditworthiness or life and health insurance pricing system under Annex III point 5(b) or (c). Systems intended for the area of Annex III point 2 are excepted. A private employer that deploys a recruitment tool under Annex III point 4 is a deployer under Art. 26 and a controller under the GDPR, and owes a DPIA where Art. 35(3)(a) is met, but no FRIA unless it falls within one of the three Art. 27(1) categories. The Art. 27 obligation page lists the elements and their split.
Art. 27(4) governs the overlap. Where an Art. 27 obligation is already met through a DPIA under Art. 35 of Regulation (EU) 2016/679 or Art. 27 of Directive (EU) 2016/680, the deployer may include cross-references to the relevant sections of that DPIA, or include the relevant parts of it, in the FRIA; the FRIA complements the DPIA. The regulation entry for this point records what Regulation (EU) 2026/1744 changed: "Amended Art. 27(4) and (5): deployers may cross-reference or include parts of a GDPR data protection impact assessment, and the AI Office template must allow this. Art. 27 sits in Chapter III Section 3, which amended Art. 113(c) applies from the Annex III date." The application date of Art. 27 is an unsettled point. Under the alternative reading the duty stayed on the general application date In force and already applies; a record prepared on that reading also meets the working reading.
| Point | DPIA, Regulation (EU) 2016/679 | FRIA, Regulation (EU) 2024/1689 |
|---|---|---|
| Who owes it | The controller (Art. 35(1)) | A body governed by public law, a private entity providing public services, or a deployer of an Annex III point 5(b) or (c) system (Art. 27(1)) |
| Trigger | Processing likely to result in a high risk to the rights and freedoms of natural persons, including the Art. 35(3)(a) case of automated evaluation with legal or similarly significant effects | First use of a high-risk AI system referred to in Art. 6(2), except systems intended for the area of Annex III point 2 (Art. 27(1) and 27(2)) |
| Object | The impact of the envisaged processing operations on the protection of personal data (Art. 35(1)) | The impact on fundamental rights that the use of the system may produce (Art. 27(1)) |
| Minimum content | A description of the processing and its purposes, a necessity and proportionality assessment, the risks to data subjects, and the measures to address them (Art. 35(7)(a) to (d)) | The deployer's processes and context of use, the period and frequency, the affected persons and groups, the specific risks of harm, the human oversight implementation, and the measures if risks materialise, including governance and a complaint mechanism (Art. 27(1)(a) to (f)) |
| Provider information | No provider information is referenced in Art. 35(7) | The risks of harm take into account the information the provider supplies under Art. 13 (Art. 27(1)(d)) |
| Notification | Prior consultation of the supervisory authority where the residual risk is high (Art. 36(1)) | Notification of the results to the market surveillance authority with the filled-out AI Office template (Art. 27(3) and 27(5)) |
| Update | A review at least when the risk represented by the processing changes (Art. 35(11)) | An update when any Art. 27(1) element has changed or is no longer up to date (Art. 27(2)) |
| Relation | The DPIA sections may be cross-referenced or included in the FRIA (Art. 27(4)) | The FRIA complements the DPIA (Art. 27(4)) |
A DPIA on its own does not meet Art. 27, because the elements in Art. 27(1)(c) to (f) reach beyond personal data: the affected groups in the specific context, the human oversight measures as implemented, and the complaint mechanism have no counterpart in Art. 35(7). The obligation record lists as a common finding a DPIA attached in full instead of cross-referenced per Art. 27(1) element, so that the elements the FRIA has to complement are not visible. The record structure for the FRIA comes from ISO/IEC 42005:2025Published, a published ISO/IEC standard; no harmonised standard covers the fundamental rights impact assessment, and none is cited in the Official Journal as of the anchor date, so no presumption of conformity attaches to the record.
The sequence
The work runs in the order below: the scope determination first, then the DPIA as a source document, then the cross-reference map, then the elements the DPIA does not hold, then the notification.
Record the deployer category claimed under Art. 27(1), the counsel reference, and the high-risk determination under Art. 6(2).
Record Scope record with the deployer category, the counsel reference and the Annex III point 2 exception check
[Regulation (EU) 2024/1689, Art. 27(1) and Art. 6(2); PR-27-FRIA steps 2 to 3]
Collect the DPIA with its version, hash and section numbering, so that each cross-reference resolves to a numbered section.
Record Source document register, DPIA entry with version, hash and section list
[Regulation (EU) 2024/1689, Art. 27(4); PR-27-FRIA steps 5 to 6]
Open the FRIA record with one section per Art. 27(1) element and one owner role per section.
Record Fundamental rights impact assessment record, one section per Art. 27(1) element
[Regulation (EU) 2024/1689, Art. 27(1); PR-27-FRIA step 11]
Follow each cross-reference and record whether the cited section holds the content of the element.
Record DPIA cross-reference map, result column per cross-reference
[Regulation (EU) 2024/1689, Art. 27(4); PR-27-FRIA step 30]
Map each Art. 27(1) element to the DPIA section that meets it, or mark the element open.
Record DPIA cross-reference map, element coverage per Art. 27(1) point
[Regulation (EU) 2024/1689, Art. 27(4); PR-27-FRIA step 33]
Build the open elements: affected groups, risks of harm with the Art. 13 information, oversight measures, complaint mechanism.
Record Affected-groups mapping, risks of harm register, oversight comparison table and complaint route test record
[Regulation (EU) 2024/1689, Art. 27(1)(c) to (f); PR-27-FRIA steps 16 to 29]
Record one review trigger per element, including a revision of the DPIA under Art. 35(11).
Record Review trigger list, one trigger per element, with the DPIA review under Art. 35(11) as a trigger
[Regulation (EU) 2024/1689, Art. 27(2); PR-27-FRIA step 34]
Assemble and approve the record, then complete the notification checklist against the AI Office template.
Record Assembled and approved record with the market surveillance authority notification checklist
[Regulation (EU) 2024/1689, Art. 27(3) and Art. 27(5); PR-27-FRIA steps 36 to 38]
Evidence this situation ends with
| Artifact | Answers | Produced by |
|---|---|---|
| Data protection impact assessment cross-reference map (Art. 27(4)) | Art. 27(4): each Art. 27(1) element met through the DPIA, the section that meets it, and the result of the check | PR-27-FRIA v1.0 |
| Fundamental rights impact assessment record (PR-27-FRIA output) | Art. 27(1)(a) to (f): the six elements in one record, in the clause order of a published ISO/IEC standard | PR-27-FRIA v1.0 |
| Affected persons and groups mapping (Art. 27(1)(c)) | Art. 27(1)(c): the categories of natural persons and groups likely to be affected in the specific context | PR-27-FRIA v1.0 |
| Risks of harm register with Art. 13 information cross-referenced (Art. 27(1)(d)) | Art. 27(1)(d): each risk of harm tied to a group and to the provider's accuracy, limitation and residual-risk information | PR-27-FRIA v1.0 |
| Human oversight implementation description (Art. 27(1)(e)) | Art. 27(1)(e): the oversight measures in place in the deployment, compared with the instructions for use | PR-27-FRIA v1.0 |
| Internal governance and complaint mechanism description (Art. 27(1)(f)) | Art. 27(1)(f): the governance arrangement and each complaint channel, with the test complaint result | PR-27-FRIA v1.0 |
| Market surveillance authority notification record with the filled-out template (Art. 27(3)) | Art. 27(3) and 27(5): the notification submitted, or the Art. 46(1) basis for exemption | the deployer, from the checklist PR-27-FRIA v1.0 produces |
Each artifact follows a specification with a synthetic sample on the deliverables page: the record, the mapping and the cross-reference section follow the FRIA record specification, the oversight and complaint-handling description follows the assessment memo specification, and the notification checklist follows the register or checklist specification. The DPIA itself stays the controller's record under Regulation (EU) 2016/679; the protocol reads it as a source document and does not assess it against Art. 35.
If nothing is done
A deployer within Art. 27(1) that first uses the system after the application date without the assessment is an operator under Art. 3(8) and falls within the market surveillance procedure of Art. 79: where the market surveillance authority finds that the obligations of the Regulation are not met, it requires the relevant operator to take corrective action, to withdraw the system or to recall it within a period the authority sets, under Art. 79(2). Art. 27 is not among the provisions listed in the penalty tier of Art. 99(4), which names the deployer duties under Art. 26 in point (e); the Art. 27(3) notification is itself the record the market surveillance authority receives, so a missing notification is visible to that authority. On the GDPR side, a missing or outdated DPIA falls under the corrective powers of the supervisory authority in Art. 58(2) of Regulation (EU) 2016/679 and the penalty tier of Art. 83(4)(a). The action that follows from the deployer's side is the sequence above: the assessment before first use under Art. 27(1), the cross-reference map under Art. 27(4), and the notification under Art. 27(3).
Services, guides and tools for this situation
The FRIA facilitation and evidence structuring service runs PR-27-FRIA v1.0 on the record and the cross-reference map, within the limits stated on what we cannot do; the oversight controls themselves are tested under logging and human-oversight verification against Art. 14 and Art. 26.
- Obligations
- Guides
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.