Conduct a Fundamental Rights Impact Assessment Before Applicable High-Risk AI Deployment

Sub-obligations

These are independently assessable parts of the parent requirement.

1. Article 27(1)(a)-(c)

   Upcoming

   Document the Intended Process, Use Period and Frequency, and Affected Persons in the FRIA

   Tracker Guidance

   Document the processes in which the high-risk AI system will be used, the intended period and frequency of use, and the categories of natural persons and groups likely to be affected in the specific context.

   Official text

   (a) a description of the deployer’s processes in which the high-risk AI system will be used in line with its intended purpose; (b) a description of the period of time within which, and the frequency with which, each high-risk AI system is intended to be used; (c) the categories of natural persons and groups likely to be affected by its use in the specific context;

2. Article 27(1)(d)-(e)

   Upcoming

   Assess Fundamental Rights Risks and Document Human Oversight in the FRIA

   Tracker Guidance

   Identify the specific risks of harm that may affect the people or groups identified in the FRIA, taking the provider's Article 13 information into account, and document how the required human-oversight measures will be implemented.

   Official text

   (d) the specific risks of harm likely to have an impact on the categories of natural persons or groups of persons identified pursuant to point (c) of this paragraph, taking into account the information given by the provider pursuant to Article 13; (e) a description of the implementation of human oversight measures, according to the instructions for use;

3. Article 27(1)(f)

   Upcoming

   Define FRIA Mitigation, Internal Governance and Complaint Arrangements

   Tracker Guidance

   Document the measures your organization will take if the identified fundamental-rights risks materialise, including relevant internal-governance arrangements and complaint mechanisms.

   Official text

   (f) the measures to be taken in the case of the materialisation of those risks, including the arrangements for internal governance and complaint mechanisms.

4. Article 27(2)

   Upcoming

   Update the Fundamental Rights Impact Assessment When Relevant Circumstances Change

   Tracker Guidance

   The FRIA requirement applies to the first use of the high-risk AI system. In similar cases, your organization may rely on previously conducted FRIAs or existing provider impact assessments. If relevant FRIA information changes or is no longer current during use, update the assessment information.

   Official text

   2. The obligation laid down in paragraph 1 applies to the first use of the high-risk AI system. The deployer may, in similar cases, rely on previously conducted fundamental rights impact assessments or existing impact assessments carried out by provider. If, during the use of the high-risk AI system, the deployer considers that any of the elements listed in paragraph 1 has changed or is no longer up to date, the deployer shall take the necessary steps to update the information.

5. Article 27(3)

   Upcoming

   Notify the Market-Surveillance Authority of the FRIA Results

   Tracker Guidance

   After completing the FRIA, notify the market-surveillance authority of the results using the Article 27 template. The Article 46(1) derogation may exempt a deployer from this notification requirement.

   Official text

   3. Once the assessment referred to in paragraph 1 of this Article has been performed, the deployer shall notify the market surveillance authority of its results, submitting the filled-out template referred to in paragraph 5 of this Article as part of the notification. In the case referred to in Article 46(1), deployers may be exempt from that obligation to notify.