AI Act Fundamental Rights Impact Assessments (Article 27): Who Needs One?

A fundamental rights impact assessment (FRIA) is one of the more unusual duties in the EU AI Act, and one of the most misunderstood. It is not required of every employer that uses AI. Article 27 applies to a defined group of deployers of high-risk AI systems, and the question "who needs one?" turns on what kind of organisation you are and what the system does. This guide sets out what the Commission's AI Act Service Desk pages say, so that Irish employers, including Dublin-based public bodies, service providers and finance teams, can work out whether Article 27 is likely to reach them.

The dates for high-risk obligations are changing, so read this alongside our overview of EU AI Act key dates for employers in Ireland. This article is general information, not legal advice.

What Article 27 requires

The Service Desk page for Article 27 (its text is shown as the EUR-Lex consolidated version as at 27 July 2026) says that, before deploying a high-risk AI system of the kind referred to in Article 6(2), covered deployers must assess the impact the system is likely to have on fundamental rights. The assessment must describe:

• the deployer's processes in which the system will be used, in line with its intended purpose;
• the period of time and frequency with which the system is intended to be used;
• the categories of natural persons and groups likely to be affected;
• the specific risks of harm likely to affect those people or groups, taking into account the information the provider gives under Article 13;
• how human oversight measures will be implemented, in line with the instructions for use; and
• the measures to be taken if those risks materialise, including internal governance and complaint mechanisms.

In short, the assessment is a structured look at who could be harmed, how, and what you will do about it before the system goes live. Recital 96, which has its own Service Desk page (it uses the official text of 13 June 2024), says the assessment should be performed prior to deploying the high-risk system, and should be updated if the deployer considers that any relevant factor has changed.

Who needs one?

Here is where many summaries go wrong. According to the Article 27 page, the duty applies to:

• deployers that are bodies governed by public law;
• private entities providing public services; and
• deployers of the high-risk systems listed in points 5(b) and (c) of Annex III.

The page adds that the duty does not apply to systems intended for the area in Annex III point 2 (critical infrastructure). Annex III point 5(b) covers systems that assess creditworthiness or set credit scores, with systems used to detect financial fraud excluded, and point 5(c) covers risk assessment and pricing for life and health insurance. So banks, lenders and insurers deploying those specific systems are within Article 27 whether or not they are public bodies. The Annex III page shows no date of its own.

Recital 96 gives examples of what it means by private entities providing public services: it links them to public-interest tasks in education, healthcare, social services, housing and the administration of justice. The page also says deployers may, where appropriate, involve affected groups, independent experts and civil society organisations, particularly in public-sector use.

What about an ordinary private employer using an HR tool? Annex III point 4 (employment, workers' management and access to self-employment) is a high-risk area, but Article 27 as paraphrased on the Service Desk page does not list point 4 by itself. On our reading of the page, a private employer that is neither a public-law body, nor a provider of public services, nor a deployer of the point 5(b) or 5(c) systems would not fall under Article 27 just because it uses a recruitment or monitoring tool. A public-law body using the same tool would be a different case. If you are unsure which side of the line you sit on, take legal advice. That is our suggestion, not a statement from the pages.

First use, updates and reusing earlier work

The Article 27 page says the obligation applies to the first use of the high-risk system. In similar cases, deployers may rely on previous assessments, including assessments carried out by the provider. If, during use, any of the elements changes or is no longer up to date, the deployer must update the information.

That has a practical consequence. If you roll the same tool out to several teams, or extend it to a new purpose, ask whether your existing assessment still describes the process, the affected groups and the oversight measures. Document the answer either way.

Notifying the authority

The page says that, once the assessment is done, the deployer must notify the market surveillance authority of the results, using the template described in paragraph 5, and that deployers may be exempt from this in the case referred to in Article 46(1). The page shows "AMENDED" labels beside paragraphs 4 and 5 of Article 27, and the Digital Omnibus on AI is shown as having amended parts of the Act. Article 46(1), as paraphrased on the Service Desk, lets a market surveillance authority, for exceptional reasons such as public security or protection of life and health, authorise a specific high-risk system to be used in its country before conformity assessment is complete. Because parts of the article are marked as amended, check the current text and the Irish authority arrangements before relying on any summary of the notification step, including this one.

In Ireland, the gov.ie page "The EU AI Act and my organisation" (published and last updated 27 May 2026) says existing sector regulators act as competent authorities, and the AI Office of Ireland's page on national competent authorities names bodies including the Data Protection Commission, the Central Bank and the Workplace Relations Commission, with short descriptions only. Neither page tells deployers which authority receives an Article 27 notification, so we cannot say.

How it relates to a data protection impact assessment

The page says that where any of the Article 27 obligations is already met through a data protection impact assessment under GDPR Article 35, the fundamental rights assessment may complement that assessment, in the sense that the deployer can cross-reference it or include relevant parts. The page also shows an "AMENDED" label next to this part of the article. It also says the AI Office is to develop a simplified questionnaire template, possibly with an automated tool, to help deployers comply.

The Data Protection Commission's page "AI, Large Language Models and Data Protection" (dated 18 July 2024) says, in its section for AI product designers, developers and providers, that building an AI product may require a data protection impact assessment, especially where the technology or processing is new to you or you are combining data sets, and that performing one anyway may be best practice. A practical approach: run the DPIA and the rights assessment as one workstream, with a single owner and shared evidence, so the work is not duplicated. That is our suggestion.

Rights, oversight and what comes next

An FRIA is only one piece of the deployer picture. Article 86, as summarised on the Service Desk, gives a person subject to a decision based on the output of an Annex III high-risk system (except point 2), where the decision has legal effects or similarly significantly affects them and they consider it adversely affects their health, safety or fundamental rights, the right to obtain clear and meaningful explanations from the deployer. That makes the oversight and complaint measures you describe in an FRIA more than paperwork. For the wider governance picture, see our guide to AI governance for managers, and note that some uses are banned outright: our explainer on prohibited AI practices for employers in Ireland covers those.

A practical approach if you think you are in scope: list the systems, identify the affected groups, draft the six headings above, name the people responsible for oversight, and agree how complaints will be handled before launch.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does every employer using high-risk AI need a fundamental rights impact assessment?

No. On the Service Desk page, Article 27 applies to public-law bodies, private entities providing public services and deployers of the credit-scoring and life and health insurance systems in Annex III points 5(b) and (c), with Annex III point 2 excluded.

Can we reuse a provider's assessment?

The page says that in similar cases deployers may rely on previous assessments, including those carried out by the provider, and must update the information if elements change.

Is an FRIA the same as a DPIA?

No. They are separate assessments, but the page says a DPIA can be cross-referenced where it already covers some of the Article 27 obligations.

When does the duty start?

Article 27 applies to high-risk systems. The Commission's consolidated text and timeline pages show 2 December 2027 for Annex III systems, and the Commission FAQ describes the Digital Omnibus on AI as a proposal, so confirm the current position before planning.