Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Deadline for participation in AP's FRIA pilot programme by 21 September 2026

21 September 2026

21 September 2026 marks the deadline for organisations to apply for participation in the Fundamental Rights Impact Assessment (FRIA) pilot programme, a crucial preparatory step for those deploying high risk artificial intelligence (AI) systems under the forthcoming AI Act. This initiative targets both public and private entities operating within the European Union, offering early experience with the new reporting obligations.

Organisations intending to deploy high risk AI systems within the European Union must proactively engage with the requirements of the AI Act, particularly regarding fundamental rights. The FRIA pilot programme offers a structured opportunity to gain practical experience with impact assessment methodologies before the full regulatory framework applies. Participation requires submitting an application to the relevant national supervisory authority, demonstrating a commitment to ethical AI deployment and regulatory compliance. This early engagement allows for refinement of internal processes and understanding of the evidence an authority would expect to see during future compliance checks.

Successful applicants will work through the process of identifying, assessing, and mitigating risks to fundamental rights posed by their AI systems. This involves a thorough analysis of potential discriminatory impacts, privacy infringements, or other adverse effects on individuals. The work preceding the deadline involves internal assessment of AI system classification, resource allocation for impact assessments, and preparation of a robust application demonstrating the organisation's suitability for the pilot.

Organisations should ensure their data protection officers (DPOs) and legal counsel are fully briefed on the AI Act's provisions, particularly those concerning high risk AI systems and the associated compliance burdens. Proactive engagement with initiatives like the FRIA pilot programme can significantly reduce future compliance risks and foster a culture of responsible AI innovation.

AI Act sets 21 September 2026 as the point of effect, and the preparation it requires sits with teams who are measured on other work, which is why this date slips rather than the obligation being misread.

AI Act

Who this binds
Public and private organisations deploying high risk AI systems in the EU
What changed
Nothing changed today. What is fixed is the date: 21 September 2026, when organisations can register to participate in the Autoriteit Persoonsgegevens (AP) pilot programme for Fundamental Rights Impact Assessments (FRIA) under the AI Act.
What to check
Organisations should submit their application to the AP if they wish to gain early experience with FRIA reporting.
What this does not mean
This is a date in the diary, not a new obligation published today. Nothing in force changed this morning.

Send this to your team

Organisations deploying high risk AI systems in the EU should note the 21 September 2026 deadline for applying to the Fundamental Rights Impact Assessment pilot programme under the AI Act.

Today's question

A social media platform operating in New York offers an algorithmically personalised feed to all users. Under the New York SAFE for Kids Act, what is the primary obligation for this platform regarding users under 18?

  1. The platform must disable the personalised feed for all users under 18, regardless of consent.
  2. The platform must obtain verifiable parental consent to provide algorithmically personalised feeds to users under 18.
  3. The platform must provide an opt out option for personalised feeds for users under 18.
  4. The platform must only offer personalised feeds to users under 18 during daytime hours.

Answer this question on the site

Worth knowing

  1. FTC and states sue telehealth company Hims & Hers for deceptive and unlawful privacy practices

    The FTC's action against Hims & Hers for sharing medical conditions with advertising platforms signals that privacy professionals in the telehealth sector must scrutinise their data sharing agreements with third party advertisers.

  2. Baylor Genetics cybersecurity incident exposes patient and employee data

    The Baylor Genetics cybersecurity incident affecting patient and employee data reinforces the critical need for robust data security measures within the healthcare sector.

  3. Study finds HIPAA risks in healthcare review replies

    The HIPAA Journal study on healthcare review replies indicates that healthcare providers may be inadvertently creating compliance risks through their public responses to patient feedback.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.