What is a fundamental rights impact assessment?

A fundamental rights impact assessment (FRIA) is an assessment, required by Article 27 of the EU AI Act for certain deployers of high-risk AI systems, of how a system could affect the fundamental rights of the people it touches, and what will be done to prevent or reduce that harm. It is carried out before the system is first used.

Why does a FRIA matter for AI agents?

An agent that decides or drafts decisions about people, such as who gets credit or what an insurance policy costs, can affect equality, privacy, access to essential services and the right to an effective remedy. A FRIA forces the deployer to think through those effects for its own use of the system, not the provider's general description of it.

Agents raise the stakes because they act. An assessment for an agent should address not only how it reaches a conclusion but what it then does, and who can stop or reverse it. Whether AI agents need a fundamental rights impact assessment answers the scope question in detail.

Who must carry one out?

In substance, Article 27 applies to:

• deployers that are bodies governed by public law, or private entities providing public services, using high-risk systems; and
• deployers using high-risk systems to assess the creditworthiness of individuals or establish their credit score, or for risk assessment and pricing in life and health insurance.

The detail of the article is covered in EU AI Act Article 27 and the fundamental rights impact assessment.

What does it contain?

In substance, the assessment describes:

1. the deployer's processes in which the system will be used;
2. how often and for how long it will be used;
3. the categories of people likely to be affected;
4. the specific risks of harm to them;
5. the human oversight measures;
6. what will be done if the risks materialise, including governance and complaint arrangements.

Running a fundamental rights impact assessment for an AI agent walks through each part, and the fundamental rights impact assessment template for AI agents gives a format.

What does an example look like?

A consumer lender plans to use an agent that assesses personal loan applications and drafts decisions. Its FRIA describes the application process, the expected volume, the applicants affected (including people with thin credit files and self-employed applicants), and the risks: unfair refusals for groups the evidence underrepresents, and difficulty challenging a decision. Oversight: every decline is reviewed by an underwriter before it is sent. Mitigation: outcome monitoring by applicant group, a clear appeal route, and certification on the lender's own past applications, including those groups.

How is a FRIA different from a DPIA?

A data protection impact assessment under GDPR Article 35 looks at risks to people from the processing of their personal data. A FRIA looks more widely, at all fundamental rights the system could affect, including non-discrimination and access to services, whether or not the risk arises from data processing. The Act allows a FRIA to complement an existing DPIA where they overlap, so most deployers build one on the other rather than starting twice.

It also differs from voluntary impact assessments, such as those under the NIST AI RMF, which any organisation may use but no law requires; see NIST AI RMF impact assessment for AI agents. For the wider picture, see our guide to AI agent regulation.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.