Banks using an AI agent to assess individuals' creditworthiness, and insurers using one for risk assessment and pricing in life and health cover, must complete a fundamental rights impact assessment under Article 27 before first use. It records how the agent is used, who it affects, possible harms, human oversight and the response if harm occurs.
What does Article 27 require, in plain words?
Article 27 of the EU AI Act asks certain deployers of high-risk AI systems to assess the impact on people's fundamental rights before putting the system into use. The assessment must describe, in substance:
- the deployer's processes in which the system will be used, in line with its intended purpose;
- how long and how often it will be used;
- the categories of people and groups likely to be affected;
- the specific risks of harm to them, taking account of what the provider has disclosed;
- the human oversight measures in place;
- what the deployer will do if those risks materialise, including governance and complaint arrangements.
The deployer notifies the relevant market surveillance authority of the results, and updates the assessment when any of these elements changes. The general duty is set out in Article 27 fundamental rights impact assessment for AI agents.
Why are banks and insurers named?
Article 27 applies to public bodies and private entities providing public services, and also, specifically, to deployers of two high-risk uses from Annex III: evaluating the creditworthiness of natural persons or establishing their credit score, and risk assessment and pricing for natural persons in life and health insurance. Those are the uses where a wrong or biased system can shut a person out of essentials.
So a bank using an agent to support consumer lending decisions needs one, whether it built the agent or bought it. Buying does not move the duty: as explained in using an agent makes you a deployer, the bank is the deployer. A bank using an agent only for fraud detection, or for lending to companies, is outside this trigger.
What changes when the high-risk system is an agent?
A credit scoring model produces a number. An agent does more: it gathers statements, reads payslips, asks the applicant follow-up questions, drafts a recommendation and may route the case. Each step can affect rights differently, so the assessment must describe the agent's steps, not just its output.
Three points tend to be missed. First, the agent's interaction with the applicant is itself a source of risk: a confusing question or a refusal to accept a document can exclude someone before any decision is made. Second, the agent's authority matters. An agent at depth 2, drafting a recommendation for an underwriter, carries different risks from one at depth 3 approving small loans within limits. Third, the sources the agent relies on shape fairness. An agent that weighs declared income from an applicant differently from income signed by an employer may disadvantage the self-employed.
What should a bank or insurer record?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Describe processes and use | Map of each agent step in the credit or underwriting process, with its depth | Process map attached to the assessment |
| Period and frequency of use | Volumes and channels stated, reviewed when they change | Use profile with review dates |
| Categories of people affected | Named groups at particular risk, such as thin-file applicants, the self-employed, older applicants, people with health conditions | Affected-groups section with rationale |
| Specific risks of harm | Risks per step: exclusion at intake, proxy discrimination, unaffordable lending, unfair denial of cover | Risk table linked to agent capabilities |
| Human oversight | Who reviews, at which step, with what authority and training | Oversight design and approver records |
| Measures if risks materialise | Complaint route, override process, outcome monitoring by group, suspension trigger | Escalation procedures and monitoring reports |
| Notify the authority | Results sent through the required channel | Notification record |
| Keep it current | Reassessment on change of agent, sources, depth or population | Version history of the assessment |
Much of this overlaps with a data protection impact assessment under GDPR Article 35. The Act says that where a DPIA already covers an element, the FRIA complements it. The practical way to run both is set out in FRIA vs DPIA for AI agents.
What will a supervisor ask?
- Show us the assessment, and show us that it was done before first use.
- Which groups did you identify as at particular risk, and why those?
- How does the agent treat an applicant whose income comes from several sources?
- How do you monitor outcomes by group, and what have you found?
- What changed in the agent since the assessment, and was it updated?
- How can a declined applicant challenge the outcome?
What does Article 27 not cover?
It does not require you to remove every risk; it requires you to identify them, describe mitigations and act if they materialise. It does not replace fair lending rules, the duty to explain decisions to applicants, or the DPIA. It does not apply to motor or property insurance pricing, which Annex III does not list, though the same thinking is useful there. And it does not apply to the provider, which has its own risk management duty under Article 9. See AI agent regulation mapped to controls for how these fit.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme records each capability of an agent with its own depth and sources, which gives the process map in a FRIA a precise basis. Facts arrive with their provenance, so the assessment can say exactly where declared information is weighed against signed or sealed information, and the action record supports outcome monitoring by group.
Questions people ask
Can we reuse the provider's impact assessment?
You can draw on information the provider gives you, and the Act allows reliance on earlier assessments for similar cases. But the FRIA is about your processes and your customers, so the provider cannot write it for you.
Does a FRIA apply to small business lending?
The Annex III listing covers natural persons. Lending to companies is outside it, but assessments of sole traders or personal guarantors may fall inside, so check each product.
How often must the FRIA be updated?
Whenever one of its elements changes, such as the agent's steps, its depth, its sources or the people it serves. Tie review to your change process so updates are not forgotten.