What is a FRIA, and do we need one?
Short answer
A FRIA (fundamental rights impact assessment) is an assessment of how a high-risk AI system can affect people's fundamental rights. It must be done before use by public authorities, private bodies that provide public services, and businesses that use AI for credit scoring of individuals or pricing of life and health insurance. It describes the use, who is affected, the risks, human oversight and what you will do if something goes wrong. Since the Digital Omnibus, it can build on your DPIA.
Who must do a FRIA?
| Deployer | FRIA? |
|---|---|
| Public authorities using high-risk AI | Yes |
| Private bodies providing public services (e.g. on behalf of a local council) | Yes |
| Banks and lenders that credit-score individuals with AI | Yes |
| Insurers that price life and health insurance with AI | Yes |
| A private company using AI in recruitment | No – but usually a DPIA |
FRIA and DPIA in one workflow
As the two assessments overlap, it makes sense to do them together. GoalCube has a draft DPIA that is filled in from your AI use in the register, and it can serve as the basis for a FRIA.
What to do
- Describe the use.Which process, and how long and how often the AI is used.
- Describe who is affected.Which groups of people are affected.
- Identify the risks.For example discrimination, wrong decisions, no way to complain.
- Describe the oversight.Who carries out human oversight, and how.
- Describe what you do when things go wrong.Complaints, internal governance and what happens when risks materialise.
- Notify the authority.Report the results to the market surveillance authority using its template.
What the law says
- Article 27 AI Act – fundamental rights impact assessment for high-risk AI systems
- Applies together with the high-risk rules, i.e. from 2 December 2027 for Annex III.
- Regulation (EU) 2026/1744 – Digital Omnibus
- A FRIA can refer to or include parts of a DPIA; the AI Office will provide a template.
- Article 35 GDPR – DPIA
- Data protection impact assessment.
Questions and answers
Does a private company need a FRIA for recruitment?
Not under Article 27, unless you provide public services. But you will usually need a DPIA under the GDPR.
What is the difference between a FRIA and a DPIA?
A DPIA is about personal data. A FRIA covers all fundamental rights, such as non-discrimination and access to services. They overlap, and a FRIA can build on a DPIA.
When must the FRIA be ready?
Before the high-risk AI is put into use – for Annex III from 2 December 2027.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.