Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Organisations must conduct FRIAs by 1 December 2027

1 December 2027

By 1 December 2027, public and private organisations deploying high risk artificial intelligence (AI) systems in the European Union must conduct Fundamental Rights Impact Assessments (FRIAs). This obligation, stemming from the EU AI Act, requires mapping potential impacts on fundamental rights and outlining mitigation strategies before deployment.

Organisations must proactively identify and assess the potential adverse impacts of high risk AI systems on fundamental rights, such as equal treatment, human dignity, privacy, and access to essential services. This involves documenting the assessment process, including how risks are mitigated, and reporting these findings to the relevant supervisory authority.

The AP advises organisations to begin preparing now, gaining practical experience with FRIA implementation. The AP is running a pilot programme to support this, offering feedback on approaches and the European template for FRIA reporting. This early engagement helps organisations understand their AI systems better and prepare for the new obligations, even if they have no prior experience with fundamental rights assessments.

A FRIA complements a DPIA. While a DPIA focuses on privacy risks related to personal data processing, a FRIA takes a broader view, considering the potential effects of high risk AI systems on all fundamental rights. The AP plans further guidance to assist organisations in meeting their obligations under the AI Act.

EU AI Act sets 1 December 2027 as the point of effect, and the preparation it requires sits with teams who are measured on other work, which is why this date slips rather than the obligation being misread.

EU AI Act

Who this binds
Public and private organisations deploying high risk AI systems in the EU
What changed
What is fixed is the date the obligation begins to apply: 1 December 2027, when organisations must conduct FRIAs to assess the impact of high risk AI systems on fundamental rights.
What to check
Organisations should prepare to conduct FRIAs for high risk AI systems, mapping potential impacts and mitigation strategies.
What this does not mean
This is a date in the diary, not a new obligation published today. Nothing in force changed this morning.

Send this to your team

Public and private organisations deploying high risk AI systems in the EU must conduct Fundamental Rights Impact Assessments (FRIAs) by 1 December 2027, mapping potential impacts on fundamental rights and outlining mitigation strategies.

Today's question

An organisation operating in the European Union is preparing for the upcoming obligations under the EU AI Act. By what date must organisations conduct Fundamental Rights Impact Assessments (FRIAs) for high risk AI systems?

  1. 1 December 2027
  2. 1 December 2025
  3. 1 January 2026
  4. 1 January 2028

Answer this question on the site

Worth knowing

  1. Italian Garante fines ASIS Trento for using cameras in changing rooms

    Organisations operating facilities with changing rooms or other private areas must ensure no video surveillance is present, as the Italian Garante has demonstrated a clear enforcement stance against such practices.

  2. NZ Privacy Commissioner clarifies Privacy Act does not hinder child protection

    Organisations working with children in New Zealand should review the Privacy Commissioner's guidance to understand how the Privacy Act supports, rather than obstructs, necessary information sharing for child protection.

  3. EFF comments on California Governor's Executive Order on AI

    Organisations developing or deploying AI systems in California should monitor the state's executive actions and advocacy group responses to understand evolving AI governance expectations and potential future regulations.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.