Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Pilot for Fundamental Rights Impact Assessment (FRIA) for AI Systems by 21 September 2026

21 September 2026

Public organisations in the Netherlands using high risk artificial intelligence systems must conduct a Fundamental Rights Impact Assessment (FRIA) by 21 September 2026. This obligation stems from the Artificial Intelligence Act (AI Act), requiring a thorough evaluation of potential impacts on fundamental rights. Organisations should prepare by understanding the scope of their AI systems and their obligations under this new regulatory framework.

The 21 September 2026 deadline for Fundamental Rights Impact Assessments (FRIAs) under the Artificial Intelligence Act (AI Act) applies to public organisations in the Netherlands deploying high risk artificial intelligence systems. These organisations must ensure their AI systems are designed and operated in a manner that respects fundamental rights, necessitating a comprehensive assessment process. This involves identifying potential risks to individual freedoms and implementing robust mitigation strategies before the deadline.

Organisations should proactively engage with the requirements, which include documenting the purpose of the AI system, the data used, and the safeguards in place to protect individuals. The Autoriteit Persoonsgegevens is offering a pilot programme for organisations interested in gaining practical experience with FRIA reporting, providing a valuable opportunity for early engagement. Evidence of a completed and robust FRIA, demonstrating due diligence and adherence to the AI Act's principles, will be expected by supervisory authorities.

While no new obligations came into force today, this approaching deadline underscores the ongoing regulatory focus on the ethical and rights based deployment of artificial intelligence. Data protection officers and privacy counsel should advise their organisations to begin preparing for this requirement, ensuring internal processes and governance structures are adapted to meet the new standards.

AI Act sets 21 September 2026 as the point of effect, and the preparation it requires sits with teams who are measured on other work, which is why this date slips rather than the obligation being misread.

AI Act

Who this binds
Public organisations in the Netherlands using high risk AI systems
What changed
What is fixed is the date: 21 September 2026, when deadline to register for the pilot programme for the Fundamental Rights Impact Assessment (FRIA)
What to check
Organisations interested in gaining experience with FRIA reporting should apply to the Autoriteit Persoonsgegevens pilot programme.
What this does not mean
This is a date in the diary, not a new obligation published today. Nothing in force changed this morning.

Send this to your team

Public organisations in the Netherlands using high risk artificial intelligence systems must complete a Fundamental Rights Impact Assessment (FRIA) by 21 September 2026 under the Artificial Intelligence Act (AI Act).

Today's question

A large online platform operating in the EU has been designated as a Very Large Online Platform (VLOP) under the Digital Services Act. What is the primary immediate obligation triggered by this designation?

  1. To appoint a Data Protection Officer (DPO) within one month.
  2. To cease all targeted advertising activities within the EU.
  3. To assess and mitigate systemic risks stemming from its service and algorithmic systems.
  4. To obtain explicit consent from all users for data processing within 30 days.

Answer this question on the site

Worth knowing

  1. Healthcare Cyberattacks Impact Pacemakers and Millions of Patient Records

    Privacy professionals in healthcare must specifically review their incident response plans for medical device compromise, as the McKesson breach demonstrates ransomware groups are directly targeting critical patient care infrastructure.

  2. EFF urges Governor Newsom to veto California's AB 1709

    Advocacy groups like the EFF continue to challenge legislative efforts that may erode digital privacy rights for individuals in California by expanding law enforcement surveillance powers.

  3. EFF publishes guide on doxxing safety and incident response

    Individuals, particularly vulnerable populations, can leverage practical guidance from organisations like the EFF to enhance their personal data security and privacy online.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.