Certain deployers must complete a fundamental rights impact assessment before using a high-risk AI system, under Article 27 of the EU AI Act. This template sets out the sections in plain words, explains how to fill each when the system is an AI agent that acts, and gives a sample for a consumer lender.
What is a FRIA for?
It makes a deployer think, before first use, about how the system could affect people's fundamental rights in its own operation: non-discrimination, privacy, access to essential services, the right to an effective remedy. The concept is explained in what a fundamental rights impact assessment is. Its place among the other duties is shown in AI agent regulation, mapped to controls.
It is narrower than it sounds. A FRIA does not assess the model in general; it assesses this use, by this deployer, on these people, with these safeguards. That is why the same agent may need different FRIAs in different firms.
When does it apply?
Article 27 applies to deployers that are bodies governed by public law or private entities providing public services, and to deployers of high-risk systems used for creditworthiness assessment or credit scoring of natural persons, or risk assessment and pricing in life and health insurance. Other high-risk deployers may not be required to complete one, though many choose to. Whether your agents need one is covered in do AI agents need a fundamental rights impact assessment? and the article itself in EU AI Act Article 27 fundamental rights impact assessment for AI agents.
Complete it before first use and update it when relevant facts change. Where you also need a DPIA, the Act lets the FRIA build on it rather than repeat it.
How do you fill in each section?
The Act sets out what the assessment must contain, in substance:
- Process describes the deployer's process in which the agent will be used, in line with its intended purpose.
- Period and frequency says how long and how often it will be used.
- Affected people names the categories of natural persons and groups likely to be affected.
- Risks of harm sets out the specific risks to those people, taking the provider's information into account.
- Human oversight describes the oversight measures, as set out in the instructions for use.
- Measures if risks materialise covers internal governance and complaint routes.
For an agent, be concrete about what it does and does not do at each step. Risk depends on depth: an agent that drafts a summary for an underwriter creates different risks from one that declines applications. The practical method is in how to run a fundamental rights impact assessment for an AI agent. Firms outside the EU often use the NIST AI RMF's impact assessment in a similar way; see NIST AI RMF impact assessment for AI agents.
Once complete, the Act expects the deployer to notify the relevant market surveillance authority of the results, subject to limited exceptions.
The template
| No. | Section | What to write |
|---|---|---|
| 1 | Deployer and agent | Entity, agent, ID, provider |
| 2 | Process and intended purpose | Steps where the agent is used; what it does at each, with depth |
| 3 | Period and frequency of use | Start, duration, volume |
| 4 | Affected people and groups | Categories, including groups at particular risk |
| 5 | Rights potentially affected | Non-discrimination, privacy, access to services, remedy |
| 6 | Specific risks of harm | Per group, with likelihood and severity |
| 7 | Human oversight measures | Who, what they review, authority to override |
| 8 | Measures if risks materialise | Governance, complaints, redress, suspension |
| 9 | Link to DPIA | Reference; what is relied on |
| 10 | Notification | Date results sent to the authority |
| 11 | Review triggers | Changes that require an update |
| 12 | Sign-off | Named approver and date |
A worked sample
A hypothetical consumer lender, extract.
| No. | Entry |
|---|---|
| 2 | Agent reads application and bureau data, prepares an affordability summary and indicative risk band (depth 2). An underwriter decides every application |
| 3 | Continuous; around 2,000 applications a month |
| 4 | Applicants for personal loans; groups at particular risk: thin-file applicants (recent arrivals, young adults), self-employed applicants with irregular income |
| 6 | Thin-file applicants banded too high because of missing history; self-employed income misread from bank statements; underwriters over-relying on the band |
| 7 | Underwriters see the inputs, not just the band; must record a reason when they agree with a high band; can reject the summary; monthly sample by credit risk |
| 8 | Monthly outcome review by applicant group; complaints tagged where the agent was involved; credit risk may suspend the capability |
| 9 | DPIA DP-07 relied on for data flows and lawful basis |
| 11 | New data source, change to bands, change to depth, unexplained outcome differences between groups |
Row 7 addresses automation bias directly. Requiring a reason when the underwriter agrees with a high band makes agreement an act of judgement, not a click.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Can the provider complete the FRIA for us?
No. The duty sits with the deployer, because it depends on your process and your customers. The provider's documentation is an input.
How does a FRIA differ from a DPIA?
A DPIA focuses on personal data and data protection rights. A FRIA looks wider, at rights such as non-discrimination and access to services. The two overlap and should reference each other.
Should we complete one even if Article 27 does not apply?
Many firms do for high-impact uses, because the questions are useful and supervisors may ask how fairness was considered. Keep it proportionate.