Only some. Under Article 27 of the EU AI Act, a fundamental rights impact assessment is required from certain deployers of high-risk AI systems before first use: public bodies, private organisations providing public services, and deployers using high-risk systems to assess the creditworthiness of individuals or to price life and health insurance. Most back-office agents fall outside it.
What does the rule require, in plain words?
The EU AI Act (Regulation (EU) 2024/1689) takes a risk-based approach and places duties on both providers and deployers. Article 27 asks certain deployers of high-risk systems to assess, before putting the system into use, how it could affect people's fundamental rights. Our entry on what a fundamental rights impact assessment is gives the definition.
In substance, the assessment describes the deployer's process in which the system will be used, how long and how often it will be used, the categories of people likely to be affected, the specific risks of harm to them, the human oversight measures in place, and what the deployer will do if those risks materialise, including internal governance and complaint routes. The deployer must notify the relevant authority of the results. Where a data protection impact assessment already covers some of this, the fundamental rights assessment can build on it.
The Act's obligations phase in over several years, and application dates for high-risk obligations have been subject to proposed changes. Check the current timetable before planning around it.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who does it apply to?
Two conditions must both be met. The system must be high-risk under the Act, and the deployer must fall into one of the named groups.
| Deployer | Covered? |
|---|---|
| A public body using a high-risk system | Yes |
| A private organisation providing public services using a high-risk system | Yes |
| A lender using a system to assess creditworthiness or score credit for individuals | Yes |
| An insurer using a system for risk assessment and pricing in life or health insurance | Yes |
| A bank using an agent to reconcile accounts | No, not high-risk |
| An insurer using an agent to draft claims correspondence | Usually no, but check whether it feeds a high-risk use |
The full analysis is in EU AI Act Article 27 and fundamental rights impact assessments for AI.
What changes when the system is an agent?
An agent may be one part of a larger decision. If it gathers data, applies policy and drafts a credit recommendation that a person approves, it can still be part of a high-risk system used to assess creditworthiness. Splitting the process into "the agent prepares, the person decides" does not, by itself, take it out of scope.
Agents also change over time. A capability added later, or a depth raised, can change who is affected and how. The assessment should state which capabilities and depths it covers, and be revisited when they change.
How do you meet it?
| Element in substance | Control for an agent | Evidence it leaves |
|---|---|---|
| The process the system is used in | Process map with the agent's capabilities and depth | Linked to the agent's version |
| Period and frequency of use | Volumes and hours of operation | Operational data |
| People affected | Customer segments the agent's work touches | Segment list |
| Specific risks of harm | Wrong declines, unfair outcomes, exclusion | Risk table, informed by certification results |
| Human oversight | Held queue, named approvers, sampling | Rota and filed approvals |
| Response if risks materialise | Depth reduction, review route, complaints | Runbook and complaint procedure |
| Notify the authority | Submission of results | Notification record |
A fundamental rights impact assessment template for AI agents gives these as fields, and running a fundamental rights impact assessment for an AI agent sets out the steps.
What does that look like in practice?
Say a lender in the EU deploys an agent that prepares consumer loan decisions: it gathers data, applies the scorecard and drafts a recommendation, and a credit officer decides. The lender treats this as part of a high-risk credit system and runs the assessment before first use. It identifies applicants with thin credit files as a group at risk of unfair declines, adds a rule that the agent escalates those cases rather than recommending, and records that credit officers decide every decline. It notifies the authority and schedules a review for any change in the agent's depth.
How does it relate to a DPIA?
They overlap but are not the same. A DPIA focuses on personal data; a fundamental rights assessment looks at wider rights such as non-discrimination and access to services. See whether AI agents need a data protection impact assessment. The wider picture is in our guide to AI agent regulation.
Questions people ask
Do providers have to carry out the assessment?
No, it is a deployer duty. Providers have their own obligations, including information that deployers need to complete the assessment.
Can one assessment cover several agents?
If they serve the same high-risk use and process, one assessment can cover them, provided it describes each agent's role. Separate uses need separate assessments.
Does it apply outside the EU?
The Article 27 duty comes from the EU AI Act, which can reach organisations outside the EU when their systems are used in the EU. Elsewhere, check local law; data protection assessments often cover similar ground.