When does Article 27 require a FRIA?
Article 27 requires the assessment before deployment of a high-risk AI system referred to in Article 6(2), which points to the Annex III high-risk areas. The rule expressly excludes high-risk AI systems intended to be used in the area listed in point 2 of Annex III, the critical-infrastructure area.
The trigger then depends on the deployer. A FRIA is required for deployers that are bodies governed by public law, private entities providing public services, and deployers of high-risk systems in Annex III points 5(b) and 5(c), which cover creditworthiness or credit scoring and risk assessment or pricing for life and health insurance.
- Start with Article 6(2): confirm that the system is an Annex III high-risk AI system.
- Check the carve-out: Annex III point 2 critical-infrastructure systems are excluded from Article 27 FRIA, even though they may still be high-risk and are registered at national level under Article 49(5).
- Check the deployer category: public-law bodies, private entities providing public services, and deployers using Annex III point 5(b) or 5(c) systems are the Article 27 categories.
- Do not treat a provider's high-risk classification memo as a FRIA; Article 27 is a deployer-side assessment of the specific use.
Supports the Article 27 trigger, covered deployer categories, critical-infrastructure carve-out, first-use rule, notification duty, DPIA complement rule, and FRIA content list.
Commission-hosted AI Act Explorer page for Article 27 used to cross-check the FRIA article citation and official article title.
Supports registration details, including deployer EU database registration for public authorities, national registration for Annex III point 2 systems, and the Annex VIII requirement to keep FRIA and DPIA summaries up to date where applicable.