Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Fundamental Rights Impact Assessment (FRIA) becomes mandatory for high risk AI systems by 1 December 2027

1 December 2027

By 1 December 2027, organisations deploying high risk artificial intelligence (AI) systems within the European Union must have completed FRIA for each system. This obligation, stemming from the AI Act, requires a thorough evaluation of potential impacts on individuals' fundamental rights before deployment. Organisations must establish robust internal processes to conduct these assessments well in advance of the deadline.

The AI Act mandates that before 1 December 2027, any public or private organisation placing a high risk AI system on the market or putting it into service in the EU must have conducted a Fundamental Rights Impact Assessment. This assessment is a critical component of the conformity assessment procedure, requiring a detailed analysis of the system's potential adverse effects on fundamental rights, such as privacy, non discrimination, and freedom of expression. Controllers are responsible for ensuring these assessments are completed, documented, and kept up to date throughout the AI system's lifecycle.

Organisations must demonstrate that they have identified and mitigated risks to fundamental rights, including through human oversight measures and robust data governance. Evidence an authority would expect to see includes comprehensive FRIA reports, records of risk mitigation strategies, and documentation of stakeholder consultation where appropriate. This proactive approach aims to embed fundamental rights protection directly into the design and deployment of high risk AI systems, moving beyond mere compliance to a rights based development methodology.

Furthermore, the FRIA is not a one off exercise; it requires continuous monitoring and review, particularly when significant modifications are made to the AI system or its intended purpose. This iterative process ensures ongoing adherence to the AI Act's stringent requirements.

AI Act sets 1 December 2027 as the point of effect, and the preparation it requires sits with teams who are measured on other work, which is why this date slips rather than the obligation being misread.

AI Act

Who this binds
Public and private organisations deploying high risk AI systems in the EU
What changed
What is fixed is the date the obligation begins to apply: 1 December 2027, when the obligation to conduct FRIA for certain high risk AI systems, as stipulated by the AI Act, becomes mandatory.
What to check
Organisations must ensure they have processes in place to conduct FRIAs before deploying high risk AI systems.
What this does not mean
This is a date in the diary, not a new obligation published today. Nothing in force changed this morning.

Send this to your team

Organisations deploying high risk AI systems in the EU must complete a Fundamental Rights Impact Assessment for each system by 1 December 2027, as mandated by the AI Act.

Today's question

An organisation is preparing for the December 2027 deadline for Fundamental Rights Impact Assessments (FRIA) for its high risk AI systems. Which of the following is a key requirement for these assessments?

  1. The FRIA must be treated as a continuous review process
  2. The FRIA must be approved in advance by the national DPA
  3. The FRIA must quantify the financial cost of rights breaches
  4. The FRIA must be carried out by an accredited notified body

Answer this question on the site

Worth knowing

  1. EFF Advises on Limiting Apple's Siri AI Data Access in iOS 27

    Organisations developing or deploying AI features should consider user privacy controls and transparency in data access, as highlighted by EFF's guidance for Apple's Siri AI in iOS 27.

  2. HHS Office for Civil Rights Settles HIPAA Investigation with Ambry Genetics

    Healthcare providers and business associates must ensure robust compliance with the HIPAA Security Rule to protect electronic protected health information, as evidenced by the HHS OCR's settlement with Ambry Genetics.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.