Alethexis
All features

Assess risk and impact

Fundamental rights impact assessment (FRIA)

Find out whether the FRIA applies to you and, if you carry one out, document it right by right, with its approval recorded.

14-day free trialSee the demo

What it is for

The FRIA assesses the impact that the use of a high-risk AI system may have on people’s fundamental rights. Not everyone using a high-risk system owes one: Article 27(1) requires it, before deploying the Annex III high-risk systems — other than those in point 2 —, of bodies governed by public law, private entities providing public services and deployers of the systems in Annex III, point 5(b) and (c).

Its only date of application is 2 December 2027. A private company that does not provide public services or deploy those point 5 systems falls under none of the cases: there doing it is voluntary: a way of documenting diligence over a high-risk system.

Section HRA-1 of the M3 High-Risk Ready module takes you through the assessment and keeps every step traceable. The FRIA is an instrument independent of the DPIA: each has its own record, its own workflow and its own PDF.

How it works

Check whether it applies

The first block asks four questions: whether your organisation is a body governed by public law or a private entity providing public services, whether the system falls under Annex III, point 2, and whether it is one of those in point 5(b) or (c). The last two arrive ticked if the system’s classification already recorded that letter. If no case applies, the platform tells you so and you can carry on voluntarily.

Document the content block by block

People and groups affected, processes and period of use, risks of harm, human oversight measures and complaint mechanisms, each in its own block and referenced to the letters of Article 27(1). In the risks block you see the risks the risk register already holds for that system. The last block records the conclusion.

Assess each right, with no overall score

Ten rights from the Charter, from human dignity to the presumption of innocence and the right of defence, which you mark as affected or ruled out, with your reasoning. Each affected right can be assessed in a matrix, with inherent and residual risk: this is an Alethexis methodology (internal methodological control). Article 27 asks for a description of the specific risks of harm; it does not ask for them to be quantified. Rights do not offset one another, so each keeps its own level.

Refer to the DPIA without replacing the FRIA

If a DPIA for the system already covers part of what the FRIA assesses, you name it and record which sections you cross-reference or incorporate. The DPIA does not spare you the FRIA: it complements it. You can also point to a previous FRIA or to the provider’s assessment in similar cases.

Review and recorded approval

The AI Officer leads it, the DPO reviews it where personal data are involved and the Owner records the approval. Statuses: draft, under review, approval recorded and archived. If something changes later, a new version is opened and the previous one is kept as history; a risk with an inherent score of 15 or more recorded against the system flags it for review.

FRIA assessment screen (HRA-1) with the document and its status, with sample data
Demo account · fictitious data

What you get

  • FRIA PDF with a hash

    The PDF is generated when the approval is recorded: system, version and date, the Article 27(1) cases confirmed, the content of each block, the per-right assessment in its own methodology section and the recorded approvals. The platform records the file’s SHA-256 integrity hash and shows it next to the download button, so you can check the document has not changed. The PDF is generated in Spanish.

  • Evidence and history

    The PDF is filed as evidence for the system and goes into its high-risk dossier. Each new version generates a new document; earlier ones are kept.

Basis

The controls in the Alethexis catalogue that this feature helps to document, with their legal basis where they have one, and their nature.

  • LCLegal obligation with a confirmed future date
  • IMInternal methodological control
LCLegal obligation with a confirmed future dateM3-HRA-011

Assessment of the scope of the FRIA (Article 27(1))

For P5 systems under Annex III (Article 27(1) refers to Article 6(2) and does not reach Annex I systems), assess whether the deployer falls within the scope of Article 27(1): bodies governed by public law; private entities providing public services; and deployers of systems under Annex III, point 5, letters (b) (creditworthiness or credit scoring of natural persons, except systems used to detect financial fraud) and (c) (risk assessment and pricing in life and health insurance). Systems under Annex III, point 2 (critical infrastructure) are excepted. The scope is not expressed by letters: letters (a) to (f) of Article 27(1) are the content of the assessment. A positive result triggers the FRIA obligation from 2 December 2027.

Legal basis

Regulation (EU) 2024/1689, Article 27(1):

Prior to deploying a high-risk AI system referred to in Article 6(2), with the exception of high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall perform an assessment of the impact on fundamental rights that the use of such system may produce.
IMInternal methodological controlM3-HRA-020

Reusing material from the DPIA in the FRIA (Article 27(4))

The FRIA and the DPIA are independent instruments and neither replaces the other: where a case under Article 27(1) arises, the FRIA is carried out all the same. Article 27(4) allows it to include cross-references to the relevant sections of the data protection impact assessment, or to incorporate parts of that assessment. It is a power of the deployer, not a substitution. Evidence: a reference to the assessment reused and a record of which sections were cross-referenced or incorporated, retained as an annex to the FRIA.

Legal basis

No direct basis in law.

IMInternal methodological controlM3-HRA-030

Structural separation of the DPIA and the FRIA (never merged)

The FRIA (Article 27 of the AI Act) and the DPIA (Article 35 GDPR) have a different legal basis, a different scope and a different receiving authority. Although they may share information, they must be kept as separate deliverables, tables and PDFs with independent SHA-256 hashes. Neither is ever delivered as a substitute for the other.

Legal basis

No direct basis in law.

Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.

Available in

  • M3High-Risk Ready

Modules build on each other: M2 includes everything in M1, and M3 includes M1 and M2.

Related

FAQ

Is my company required to carry out a FRIA?
Only if one of the cases in Article 27(1) applies, and from 2 December 2027. A private company that does not provide public services or deploy systems under Annex III, point 5(b) or (c), falls under none of them; for that company, doing the FRIA is voluntary. If you are unsure whether you provide a public service, for instance under an agreement with a public administration, it is worth checking with an adviser.
Can I use my DPIA instead of the FRIA?
No. They are independent instruments: the FRIA looks at fundamental rights and the DPIA at the protection of personal data. Where a case under Article 27(1) applies, the FRIA has to be carried out; if the DPIA already covers any of its obligations, the FRIA can refer to its sections or incorporate them.
Do I have to score each right?
No. The per-right assessment is an Alethexis methodology and a FRIA without it can still be sent for review. If you assess an affected right, it needs its four variables — likelihood, exposure, severity and effort to reverse — and its reasoning before you send it.
Does Alethexis submit the FRIA to the authority?
No. Alethexis structures and keeps your FRIA and lets you record whether you have notified its results to the market surveillance authority. Submitting it, and the legal judgement on your case, remain with your organisation.

Try it with your own systems

14-day free trialSee the demo