A Fundamental Rights Impact Assessment is performed before high-risk use of AI.
Trigger
The organization is a public body or provides a public service, and AI is used in decisions about hiring, firing, promotion, pay, access to services or benefits.
Why
The EU AI Act obliges public bodies and organizations providing public services to perform a Fundamental Rights Impact Assessment (FRIA) before deploying high-risk AI. Public authorities must also register the high-risk use in the EU database before first use. These obligations apply from 2 December 2027.
How
Conduct and document a FRIA before first use of high-risk AI. If the use of the AI system in this high-risk process changes or a new AI system is introduced, the FRIA must be updated. Existing DPIAs can be used where those cover the required content (intended use of the AI system, affected individuals, groups or organizations, identified risks, oversight measures, etc.).
Sources
- AI Act Art. 27
- AI Act Art. 49(3)
- ISO/IEC 42001 A.5.2
- ISO/IEC 42001 A.5.3
- ISO/IEC 42001 A.5.4