Discover full dictionary

A fundamental rights impact assessment (FRIA) is the assessment that certain deployers of high-risk AI systems must perform before putting the system into use, under Art. 27 of the EU AI Act, to identify the specific risks to the fundamental rights of the individuals or groups likely to be affected and the measures to be taken if those risks materialise. The obligation applies to deployers that are bodies governed by public law or private entities providing public services (which includes hospitals and healthcare providers in many Member States), and to deployers of high-risk systems used for creditworthiness assessment and life and health insurance pricing (Annex III, point 5(b) and (c)). Other deployers may perform a FRIA voluntarily, and providers are encouraged to support them.

The FRIA must describe the deployer's processes in which the system will be used in line with its intended purpose; the period and frequency of use; the categories of natural persons and groups likely to be affected; the specific risks of harm to those persons or groups, taking into account the information provided by the provider under Art. 13; the human oversight measures according to the instructions for use; and the measures to be taken if risks materialise, including governance arrangements, complaint mechanisms and redress. Once performed, the deployer notifies the market surveillance authority using a template the AI Office is developing; the assessment is updated when relevant elements change. Where a DPIA under Art. 35 GDPR already covers some of these elements, the FRIA complements it rather than duplicating it (Art. 27(4)).

For healthcare and life sciences, a hospital deploying an AI triage, diagnostic or resource-allocation system, or an insurer using AI to price health cover, will need a FRIA from August 2026, and the analysis should extend beyond data protection to non-discrimination (bias against age, sex, ethnicity or disability in training data), access to healthcare, dignity and the right to an effective remedy, drawing on the Charter of Fundamental Rights. Pharmaceutical and MedTech providers are not themselves obliged to run FRIAs for products they place on the market, but they must supply the information deployers need and will increasingly be asked for FRIA-ready documentation in procurement. Combining the FRIA, the DPIA and the MDR clinical evaluation into one integrated impact assessment is the approach iliomad recommends; see AI compliance services.