Who must complete a FRIA?
Start with the system: it must be high-risk under Article 6(2), the Annex III use-case route. Article 27 excludes the critical-infrastructure systems listed in Annex III point 2.
Then check the deployer. The duty covers bodies governed by public law, private entities providing public services, and deployers of Annex III point 5(b) creditworthiness or credit-scoring systems or point 5(c) life and health insurance risk-assessment and pricing systems.
Complete the assessment before first use. You may rely on an earlier or provider assessment in a similar case. Check that the system, process, affected groups, risks, oversight and measures fit your deployment. Update the information if an element changes or becomes outdated during use.
- Start with Article 6(2): confirm that the system is an Annex III high-risk AI system.
- Check the carve-out: Annex III point 2 critical-infrastructure systems are excluded from Article 27 , even though they may still be high-risk and are registered at national level under Article 49(5).
- Check the deployer category: public-law bodies, private entities providing public services, and deployers using Annex III point 5(b) or 5(c) systems are the Article 27 categories.
- Do not treat a provider's high-risk classification memo as a ; Article 27 is a deployer-side assessment of the specific use.
- After completing the , notify the of the results by submitting the completed Article 27 template, unless the Article 46(1) exemption from notification applies.
Does every high-risk system need a ?
No. Article 27 applies to specified deployers before deploying Article 6(2) Annex III high-risk systems, with an express exception for the Annex III point 2 critical-infrastructure area. Product-safety high-risk systems classified under Article 6(1), and Annex III systems outside the named deployer categories, should still be assessed for other AI Act duties, but Article 27 is not automatically triggered by the high-risk label alone.
Which deployers are covered?
Article 27 names deployers that are bodies governed by public law, private entities providing public services, and deployers of high-risk systems referred to in Annex III points 5(b) and 5(c). Recital 96 explains that private public-service examples can be linked to public-interest tasks such as education, healthcare, social services, housing, and administration of justice.
What about critical-infrastructure systems?
Article 27 excludes high-risk AI systems intended for the Annex III point 2 critical-infrastructure area from the duty. That does not remove all AI Act obligations: Annex III point 2 covers safety components in critical digital infrastructure, road traffic, and water, gas, heating, or electricity supply, and Article 49(5) says those high-risk systems are registered at national level.
When does the duty apply?
Regulation (EU) 2026/1744 moves Chapter III Sections 1 to 3, except Article 6(5), to 2 December 2027 for Article 6(2) Annex III high-risk systems. This includes Article 27. For systems placed on the market or put into service before that applicable date, amended Article 111(2) separately governs transition treatment, including significant design changes and the 2 August 2030 deadline for high-risk systems intended for public-authority use. It preserves Article 5 prohibitions; it is not a grace period for every new deployment.
Citations (2)
- Regulation (EU) 2024/1689, Articles 27 and 49 and Annex VIII
Supports the Article 27 trigger, covered deployer categories, critical-infrastructure carve-out, first-use rule, notification duty, DPIA complement rule, FRIA content list, and the related deployer registration requirements.
Fundamental rights impact assessment for high-risk AI systems
- AI Act Service Desk - Article 27
Commission-hosted AI Act Explorer page for Article 27 used to cross-check the FRIA article citation and official article title.
Article 27: Fundamental rights impact assessment for high-risk AI systems