Some organisations must assess fundamental-rights impacts before using specified high-risk AI.
Check the system and deployer first. A (FRIA) is required only for the uses covered by Article 27.
A is a pre-use review of how an AI deployment may harm people's rights. Article 27 requires it for specified Annex III high-risk systems used by public-law bodies, private public-service providers, or specified credit and life/health-insurance deployers. Critical-infrastructure systems in Annex III point 2 are excluded. The amended Annex III Chapter III duties apply from 2 December 2027, subject to applicable transitions.
Both the system and the deployer must be covered. The system must be high-risk under Article 6(2), the Annex III use-case route. Article 27 excludes Annex III point 2 critical infrastructure.
Covered deployers are public-law bodies, private entities providing public services, and deployers of Annex III point 5(b) or 5(c) systems. Point 5(b) covers individual creditworthiness or credit scoring, except fraud detection. Point 5(c) covers individual life and health insurance risk assessment and pricing.
If a provider has validly documented that an Annex III system is not high-risk under Article 6(3), Article 27 is not triggered unless that classification is rejected or the system changes. Obtain the assessment and Article 49(2) registration evidence.
Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026. It moves Chapter III Sections 1-3 for Annex III systems to 2 December 2027. Article 111 separately addresses existing systems, including a 2 August 2030 deadline for systems intended for public-authority use. Record the route, duty, system history and applicable date.
Sources (3)
Supports the Article 27 trigger, the Article 6(2) link to Annex III, and the Annex III point 2 critical-infrastructure carveout.
Prior to deploying a high-risk AI system referred to in Article 6(2)
Commission Service Desk presentation of Article 27, including deployer categories and the assessment summary.
public bodies and specific private entities must perform an assessment
Binding amendment published on 24 July 2026 and entering into force on 27 July 2026; it moves the applicable Chapter III duties for Annex III high-risk systems to 2 December 2027 and amends the legacy-system transition rules.
Annex III lists high-risk use cases. Article 6(3) allows a system on that list to be treated as non-high-risk only where it does not pose a significant risk to health, safety or fundamental rights, including by not materially influencing decisions, and meets at least one listed condition.
The conditions concern narrow procedural tasks, improving completed human work, detecting patterns or deviations without replacing or influencing a completed human assessment without proper human review, or preparing an Annex III assessment. A supplier's claim that a human makes the final decision is insufficient on its own.
The provider must document the assessment before market placement or service and meet Article 49(2) registration duties. An Annex III system that profiles people always remains high-risk.
Sources (2)
Supports Article 6(2), Article 6(3), the documentation requirement for non-high-risk conclusions, and the profiling exception.
AI systems referred to in Annex III shall be considered to be high-risk
Provides Commission context for the AI Act's risk-based approach and examples of high-risk use cases.
AI use cases that can pose serious risks to health, safety or fundamental rights
Write the FRIA around your organisation's process and the people affected. Article 27 requires the deployment's specific rights impacts; the supplier's general product description cannot supply every fact.
Use the provider's Article 13 information alongside your own evidence. Cover where and how often the system operates, affected groups, possible harms, human oversight and what happens if a risk occurs. The list below covers the required contents.
Operational example: for covered credit scoring, record who may be disadvantaged by missing or inaccurate data, how trained reviewers check contested outcomes, who can suspend use and how applicants can complain. Link the supplier limitations, review procedure and complaint owner. This example helps organise the work; it is not a statutory form.
Sources (2)
Lists the Article 27 assessment contents for use, duration, affected groups, risks, oversight, and mitigation.
usage, affected groups, risks, human oversight, and mitigation measures
Primary legal text for the six Article 27 FRIA content elements and the link to Article 13 provider information.
the categories of natural persons and groups likely to be affected
A data protection impact assessment (DPIA) examines personal-data risks. Amended Article 27(4), in force from 27 July 2026, allows relevant DPIA parts to be cross-referenced or included when they already meet a FRIA obligation. This covers GDPR Article 35 and Law Enforcement Directive Article 27 assessments. Complete the remaining FRIA elements.
After the FRIA, notify the market surveillance authority by submitting the completed Article 27 template, unless a specific Article 46(1) exemption applies. Use the AI Office and receiving authority's template and filing instructions.
Article 27 limits the obligation to first use and requires an update when relevant elements change or become outdated. Set review triggers for the process, frequency, affected groups, risks, oversight, governance and complaints.
Sources (3)
Supports the Article 27 first-use rule, update rule, notification requirement, and required assessment contents.
The obligation laid down in paragraph 1 applies to the first use
Confirms the Service Desk summary that the assessment is required for first use, must be updated if changes occur, and complements existing DPIAs.
must be updated if changes occur
Amended Article 27(4) permits relevant DPIA sections to be cross-referenced or included in the FRIA when they satisfy an Article 27 obligation.
Under Article 49, public authorities, EU institutions, bodies, offices and agencies, and people acting on their behalf must register before using an Annex III high-risk system, except point 2 critical infrastructure. Keep registration and FRIA evidence connected.
Annex VIII Section C requires deployer and submitter details, the provider's EU database entry URL, a FRIA findings summary and a DPIA summary where applicable. The bullets below distinguish provider, deployer and special registration routes.
No. Article 27 covers specified deployers using Article 6(2) Annex III high-risk systems. It excludes Annex III point 2 critical infrastructure. High-risk classification under the Article 6(1) product route alone does not trigger a FRIA.
Yes, for elements it already covers. Since 27 July 2026, amended Article 27 allows relevant DPIA sections to be cross-referenced or included. Complete any remaining FRIA work on use, affected people, rights risks, oversight, mitigation, governance, complaints, notification and registration.
Complete the Article 27 template. Include the deployment process, use period and frequency, affected people, risks of harm, human oversight, mitigation, governance and complaints arrangements, with the linked DPIA summary where applicable.
Sources (2)
Supports Article 49 registration duties, the Annex III point 2 exception, secure non-public sections, and national-level registration for critical infrastructure systems.
Certain high-risk AI systems used in the area of critical infrastructure are registered at the national level.
Primary legal text for Article 49 and Annex VIII registration fields, including deployer FRIA and DPIA summaries.
A summary of the findings of the fundamental rights impact assessment
Sorena can help check whether Article 27 applies and organise assessment, notification and registration records.
"Fundamental rights impact assessment for high-risk AI systems"
"Prior to deploying a high-risk AI system referred to in Article 6(2)"
"AI systems referred to in Annex III shall be considered to be high-risk"
"the categories of natural persons and groups likely to be affected"
"The obligation laid down in paragraph 1 applies to the first use"
"A summary of the findings of the fundamental rights impact assessment"
"The assessment complements existing data protection impact assessments."
"public bodies and specific private entities must perform an assessment"
"usage, affected groups, risks, human oversight, and mitigation measures"
"must be updated if changes occur"
"Providers must register themselves and their systems in the EU database"
"Certain high-risk AI systems used in the area of critical infrastructure are registered at the national level."
"The AI Act defines 4 levels of risk for AI systems"
"AI use cases that can pose serious risks to health, safety or fundamental rights"
Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.
Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.
Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.
Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.
Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.
Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.
See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.
Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.
Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.
Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.
Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.
Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.
Check each AI tool, decide which duties apply, and give every action an owner and evidence link.
Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.
Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.
Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.
High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.
Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.
Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.
Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.
Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.
Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.
Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.
Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.
Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.
Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.
Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.
Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.
See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.
See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.
Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.
Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.
Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.
Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.