Digital Lexicon Hub

An assessment certain deployers must complete under EU AI Act Article 27 before using a high-risk AI system, focused on effects on people's rights.

Public bodies, private providers of public services, and deployers of credit scoring or life and health insurance pricing systems need a completed FRIA before first use, and must notify the market surveillance authority of the results.

A regional bank planning an AI credit scoring tool describes the lending process it supports, about 3,000 applications a month, the applicant groups affected, bias risks from the provider's documentation, loan officer review steps and an appeal channel.

A FRIA is not a one-time form: it must be updated when any element changes. It complements rather than replaces a GDPR data protection impact assessment, and its quality depends heavily on the information the provider supplies.

Article 27 requires a description of the deployer's processes, the period and frequency of use, the categories of people affected, the specific risks of harm, human oversight measures and the steps taken if risks materialize, including governance and complaint mechanisms. It applies before first use, may reuse earlier assessments and may cross-reference a DPIA. The AI Office must develop a questionnaire template, including an automated tool, and ISO/IEC 42005:2025 offers related AI Impact Assessment guidance.