Fundamental rights impact assessment under the EU AI Act: who needs one

Under Article 27, certain deployers of high-risk AI systems must carry out a fundamental rights impact assessment before first use. That covers public bodies, private entities providing public services, and deployers of credit scoring and life or health insurance pricing systems. It must describe processes, affected groups, risks, oversight and remedies.

Who must do it

Article 27(1) applies to deployers that are:

• Bodies governed by public law.
• Private entities providing public services.
• Deployers of Annex III point 5(b) systems (creditworthiness) and point 5(c) systems (risk assessment and pricing for life and health insurance).

Annex III point 2, critical infrastructure, is excluded from the duty. A deployer outside these groups does not have a statutory duty under this article, though doing a lighter version can still be sensible.

What it must contain

Article 27(1) lists six elements:

1. How the deployer's processes will use the system, in line with its intended purpose.
2. The period and frequency of use.
3. The categories of people and groups likely to be affected.
4. The specific risks of harm to those groups, taking into account the provider's Article 13 information.
5. How human oversight will be implemented per the instructions for use.
6. The measures if the risks materialise, including internal governance and complaint mechanisms.

Reuse and updates

Deployers may rely on earlier assessments for similar cases and must update the information if any element changes. The results are notified to the market surveillance authority using a template. If a data protection impact assessment already covers these obligations, it can be cross-referenced or included in the assessment.

A workable method

• Start from the provider's instructions for use. You cannot describe intended purpose without them.
• Map the decision the system supports and who is on the receiving end.
• List rights that could be affected: non-discrimination, privacy, access to services, effective remedy.
• Rate each risk and name the control.
• Write the complaint route in plain words, with a named owner.
• Set a review date and change triggers.

Involve legal, the business owner and someone who can speak for affected users.

Common gaps

• Treating it as a copy of a DPIA when the question is broader than personal data.
• Describing the vendor's marketing instead of your own use.
• No owner for complaints.
• No link between the assessment and actual oversight staffing.

Timing

Article 27 sits in the high-risk chapter, so it follows the high-risk dates of 2 December 2027 for Annex III uses. Building the habit earlier costs little.

Pilot the method on one system before rolling it out. A first run usually exposes missing inputs, such as an absent instructions for use document or no clear owner for complaints. Fix those gaps, then reuse the template for similar systems, which Article 27(2) permits where the cases are alike.

Quick check

Sources

• AI Act Article 27, fundamental rights impact assessment (an unofficial reader; confirm wording against the Official Journal)
• AI Act Annex III

Last reviewed: 19 October 2026.