How to Run an EU AI Act Fundamental Rights Impact Assessment

Key Takeaways

From December 2, 2027, Article 27 of the EU AI Act requires deployers of high-risk credit scoring and life and health insurance risk assessment and pricing systems to assess the impact on fundamental rights before first use.
That date comes from Regulation (EU) 2026/1744, which in Article 27 changed paragraphs 4 and 5 alone; how the duty reaches systems already in use is a question for counsel (interpretation).
The assessment covers six elements: processes, period and frequency, affected groups, specific risks, human oversight, and measures including complaint mechanisms.
Since 2026/1744, a deployer may cross-reference its GDPR DPIA in the assessment; the FRIA still needs elements the DPIA does not name.
Results go to the market surveillance authority, for financial institutions generally their financial supervisor; we found no AI Office template yet, so structure the file to transfer (interpretation).

Current as of October 29, 2026. This guide draws on the EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744, the General Data Protection Regulation (Regulation (EU) 2016/679), and the European Commission's AI Act FAQ page and AI Act Service Desk, as published on that date. How it applies depends on the firm and the system; it is not legal advice.

A bank or insurer using a high-risk AI system to score individuals' creditworthiness, or to assess risk and set prices for individuals in life and health insurance, owes a duty its vendor does not: before use, assess what that use may do to people's fundamental rights, and report the result. Classification is covered in our guide to classifying credit and insurance AI.

Unless a step below quotes the Act or another text, it is our recommendation, labeled (interpretation).

What is settled, and what is not

Settled: Article 27(1) applies, among others, to "deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III", which "shall perform an assessment of the impact on fundamental rights that the use of such system may produce." Recital 96 gives "such as banking or insurance entities" as examples.
Settled: Article 27 sits in Section 3 of Chapter III. Regulation (EU) 2026/1744, in force since July 2026, set December 2, 2027 as the date from which Sections 1 to 3 of Chapter III, with the exception of Article 6(5), apply to Annex III systems, so the assessment duty runs from that date for credit scoring systems and life and health insurance risk assessment and pricing systems.
Settled: Regulation (EU) 2026/1744 rewrote two paragraphs of Article 27: paragraph 4, on reusing a GDPR data protection impact assessment, and paragraph 5, on the AI Office template. It did not amend paragraphs 1 to 3 (who, what, when, and notification).
Not settled: the template. Article 27(3) requires the filled-out AI Office template to be submitted with the notification, and Article 27(5) sets no deadline for producing it. We found no Article 27 template or questionnaire, final or draft, on the four pages of the AI Act Service Desk's resources list or the Commission's AI Act FAQ page reviewed on October 29, 2026. The templates listed there concern general-purpose AI models and serious-incident reporting.
Not settled: systems already in use. As amended, Article 111(2) applies the Act to operators of high-risk systems placed on the market or put into service before the Chapter III application date "only if, as from that date, those systems are subject to significant changes in their designs." Operators include deployers. Recital 39 of Regulation (EU) 2026/1744 applies that grace period by type and model: if one unit was lawfully placed on the market or put into service before that date, "other individual units of the same type and model of high-risk AI system are subject to the grace period provided in that Article 111(2)", as long as the design of that high-risk AI system remains unchanged. The recital speaks of providers and does not mention the assessment; how it affects a deployer's assessment for a legacy system, or one adopted later, is not settled in the texts reviewed; settle it with counsel (interpretation).

On scope: the AI Act and the GDPR are regulations, binding and directly applicable in every Member State; the GDPR has applied since May 25, 2018. The Commission's FAQ page and Service Desk summaries explain the Act but are not the Act; the Service Desk says its summaries are not legally binding.

Step 1: Confirm the firm is the deployer of a 5(b) or 5(c) high-risk system

The Act defines a deployer as a person or body "using an AI system under its authority", other than in personal non-professional use. Article 27(1) attaches the duty to high-risk systems referred to in Article 6(2), so a credit or insurance system that its provider has documented as not high-risk under Article 6(3) falls outside it, provided that assessment holds (interpretation). Recheck it first against the Act's profiling rule: Article 6(3) adds that an Annex III system "shall always be considered to be high-risk where the AI system performs profiling of natural persons", so for a system that scores individual applicants or insured persons the derogation will rarely be open (interpretation).

A bank that builds its own scoring model and uses it is likely both its provider and its deployer, and owes the assessment as deployer (interpretation). The Commission's FAQ page says "certain deployers" must conduct it, then refers to "operators providing high-risk AI systems that carry out credit worthiness assessments or price and risk assessments in life and health insurance"; Article 27(1) says deployers, and the Act's wording is what binds.

Step 2: Describe the deployment, not the model: processes, period and frequency

Article 27(1)(a) requires "a description of the deployer's processes in which the high-risk AI system will be used in line with its intended purpose", and 27(1)(b) "a description of the period of time within which, and the frequency with which, each high-risk AI system is intended to be used".

Write these as a business process: products, channels, decision points, whether the system decides, recommends or ranks, and decision volumes (interpretation). A use outside the provider's documented intended purpose means reclassifying first (interpretation).

Article 27(2) lets the deployer rely on earlier assessments, including existing ones carried out by the provider, "in similar cases"; record the differences (interpretation).

Step 3: Identify the people and groups the credit or pricing decision affects

Article 27(1)(c) requires "the categories of natural persons and groups likely to be affected by its use in the specific context".

For lending or underwriting, that list usually reaches beyond applicants: declined applicants, co-applicants and guarantors, customers whose limits or premiums the system revises, and people the data describes poorly, such as those with thin credit files (interpretation). Name groups by the characteristics in Step 4 as well as by product (interpretation).

Step 4: Assess specific risks of harm, starting from the provider's instructions for use

Article 27(1)(d) requires "the specific risks of harm likely to have an impact on the categories of natural persons or groups of persons identified pursuant to point (c) of this paragraph, taking into account the information given by the provider pursuant to Article 13".

Under Article 13, that information includes, among other things, any known or foreseeable circumstance that may lead to risks to fundamental rights and, when appropriate, "its performance regarding specific persons or groups of persons on which the system is intended to be used". Request it at procurement, and record any gap as a risk (interpretation).

Recital 58 says credit scoring systems "may lead to discrimination between persons or groups and may perpetuate historical patterns of discrimination, such as that based on racial or ethnic origins, gender, disabilities, age or sexual orientation, or may create new forms of discriminatory impacts." For life and health insurance it lists consequences for people's life and health "including financial exclusion and discrimination." Test outcomes for the Step 3 groups against those harms and record the method and results (interpretation).

Step 5: Record human oversight, and the governance and complaint measures if risks occur

Article 27(1)(e) requires "a description of the implementation of human oversight measures, according to the instructions for use". Article 26(2) requires deployers to "assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support." Name the roles and when they may override or stop the system (interpretation).

Article 27(1)(f) requires the measures to be taken if those risks occur, including the arrangements for internal governance and complaint mechanisms. Recital 96 gives complaint handling and redress procedures as examples. Two related duties: under Article 26(11), deployers of Annex III systems that make or assist decisions about natural persons "shall inform the natural persons that they are subject to the use of the high-risk AI system." Under Article 86, a person affected by such a decision, with legal or similarly significant effects they consider adverse, may obtain from the deployer "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken", where Union law does not already provide that right. Route complaints to someone who can explain and, if needed, reverse the decision (interpretation).

These systems may also need a data protection impact assessment under GDPR Article 35, a controller's duty, which names among the cases requiring one "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person".

As amended by Regulation (EU) 2026/1744, Article 27(4) provides that where an obligation is already met through the DPIA, "the deployer may, when conducting the fundamental rights impact assessment referred to in paragraph 1 of this Article, include cross-references to the relevant sections of that data protection impact assessment or include relevant parts thereof in the fundamental rights impact assessment." The original text said the FRIA would complement the DPIA. The Commission's FAQ page, last updated October 20, 2026, puts it differently: "To avoid substantive overlaps in such cases, the fundamental rights impact assessment shall be conducted in conjunction with that data protection impact assessment." That is the Commission's summary, not the amended article.

The overlap is partial: GDPR Article 35(7)'s minimum contents do not name the period and frequency of use or the human oversight measures that Article 27(1) does. Keep the FRIA as its own document citing DPIA sections where they answer an element (interpretation).

Step 7: Notify the financial supervisor and keep the assessment current

Article 27(3): "Once the assessment referred to in paragraph 1 of this Article has been performed, the deployer shall notify the market surveillance authority of its results, submitting the filled-out template referred to in paragraph 5 of this Article as part of the notification." For financial institutions regulated by Union financial services law, Article 74(6) makes that authority their national financial supervisor for uses directly connected with those services, unless a Member State designates another under Article 74(7).

With no template found in what we reviewed, structure the assessment under headings (a) to (f) so it can move into the AI Office template once published, and ask the supervisor how to notify meanwhile (interpretation).

Article 27(2) adds: "If, during the use of the high-risk AI system, the deployer considers that any of the elements listed in paragraph 1 has changed or is no longer up to date, the deployer shall take the necessary steps to update the information." Set update triggers: a vendor model change, a new product or population, a change in oversight, or a pattern in complaints or outcome testing (interpretation). Article 27 does not say whether an update is notified again; record the decision (interpretation).

Checklist

Items restate the recommendations above (interpretation).

Each 5(b) and 5(c) system records its classification and the firm's role
The assessment describes processes, period and frequency of use, within the provider's intended purpose
Affected persons and groups are named by product and by characteristics the Act flags
Risks of harm are assessed from the provider's Article 13 information and the firm's own outcome testing
Human oversight roles, notices to individuals, explanations and complaint routes are written down
DPIA sections are cross-referenced rather than copied, with each Article 27(1) element visibly answered
The supervisor's notification route is confirmed, update triggers are set, and the template is adopted when published

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.

Frequently Asked Questions

Does a bank or insurer using a vendor's credit scoring or life or health insurance underwriting system need a fundamental rights impact assessment?

Yes, if the system is high-risk under Annex III point 5(b) or 5(c) and the firm is using it under its authority. Article 27(1) of the EU AI Act places the duty on deployers of those systems, not on the vendor. Under Article 27(2), the deployer may rely on existing impact assessments carried out by the provider in similar cases.

When does the fundamental rights impact assessment duty apply?

Regulation (EU) 2026/1744 set December 2, 2027 as the date from which Chapter III, Sections 1 to 3, which include Article 27, apply to Annex III systems. The assessment must be done before the system's first use. How the duty applies to systems already in use before that date, under Article 111(2) as amended, is not settled in the texts reviewed for this guide.

Can a GDPR data protection impact assessment count as the fundamental rights impact assessment?

Not on its own. Since Regulation (EU) 2026/1744, Article 27(4) lets the deployer cross-reference or include relevant parts of the DPIA where they already meet an Article 27 obligation. The FRIA also requires elements the GDPR's minimum DPIA contents do not name, such as period and frequency of use and human oversight measures.

Has the AI Office published the fundamental rights impact assessment template?

We found none, final or draft, on the AI Act Service Desk's resources list or the Commission's AI Act FAQ page reviewed on October 29, 2026. Article 27(3) still requires the filled-out template with the notification, so structuring the assessment under Article 27(1)(a) to (f) and asking the supervisor how to notify in the meantime is our recommendation (interpretation).