fundamental rights impact assessment
In plain wordsA check that certain organizations must make before using a high-risk AI system, writing down whose rights it could affect, how, and what they will do to prevent harm.
An assessment that certain deployers must carry out under the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models. before first using a high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks. listed in Annex III, other than in critical infrastructure. It is required of public bodies, private entities providing public services, and deployers using AI to assess creditworthiness or to price life and health insurance. It identifies the people and groups the system is likely to affect and the harms they could suffer, sets out how, for how long and how often the system will be used within the deployer's operations, describes the human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked. arrangements, and states what the deployer will do, through internal governance and complaint channels, if those harms materialize. The deployer notifies the results to the market surveillance authority on a template from the AI OfficeAI Office, prop. n.: The European Commission's team that oversees the EU AI Act, especially the rules for the largest AI models, and coordinates how the law is applied across Europe. and may build on an existing data protection impact assessment.
Before rolling out the benefits-fraud model, the agency completed a fundamental rights impact assessment.
Origin
Not in the Commission's 2021 proposal; added at the European Parliament's insistence in 2023 and narrowed in the December 2023 political agreement to public bodies and certain private deployers. It parallels the data protection impact assessment of the GDPR (Article 35).
Usage note
Distinct from the provider's risk management system and from algorithmic impact assessmentsalgorithmic impact assessment, n.: A structured review, done before and during the use of an automated system, of whom it could affect and how — such as unfair treatment or privacy harms — and what will be done about it. such as those under Canada's Directive on Automated Decision-Making. Since the 2026 Digital OmnibusDigital Omnibus, prop. n.: A European Union package, proposed in 2025, that simplified and delayed parts of its digital rules — above all pushing back the strictest requirements of the EU AI Act by more than a year., the AI Office's questionnaire template may cross-refer to the deployer's data protection impact assessment.
Related
- high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks.
- provider and deployerprovider and deployer, phr.: The two main roles in EU AI law: the provider is whoever makes an AI system and puts it out under its own name; the deployer is whoever uses it for work or official purposes.
- algorithmic impact assessmentalgorithmic impact assessment, n.: A structured review, done before and during the use of an automated system, of whom it could affect and how — such as unfair treatment or privacy harms — and what will be done about it.
- human oversighthuman oversight, n.: Keeping people able to watch, understand, question and, if necessary, stop or overrule an AI system, rather than letting it act unchecked.
- General Data Protection RegulationGeneral Data Protection Regulation, prop. n.: The European Union's main privacy law, in force since 2018, which controls how personal information is collected and used — including to train and run AI systems.
- EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models.
Defined in law or standards
EU AI Act (Reg. (EU) 2024/1689), Art. 27, as amended by Reg. (EU) 2026/1744
Mentioned in
high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks., algorithmic impact assessmentalgorithmic impact assessment, n.: A structured review, done before and during the use of an automated system, of whom it could affect and how — such as unfair treatment or privacy harms — and what will be done about it., General Data Protection RegulationGeneral Data Protection Regulation, prop. n.: The European Union's main privacy law, in force since 2018, which controls how personal information is collected and used — including to train and run AI systems., provider and deployerprovider and deployer, phr.: The two main roles in EU AI law: the provider is whoever makes an AI system and puts it out under its own name; the deployer is whoever uses it for work or official purposes., remote biometric identificationremote biometric identification, n.: Using AI to recognize people at a distance — usually by matching faces in camera footage against a database — without their taking part. The EU strictly limits live police use of it in public places.