Fundamental rights

EU AI Act FRIA template and readiness checklist

A Fundamental Rights Impact Assessment is a structured examination of how certain high-risk AI deployments may affect people. The first task is to establish applicability; the second is to gather facts without turning the template into an automatic legal conclusion.

Prepared by EU AI Fit editorial team · Published 24 August 2026 · Source review 31 August 2026

1. Screen whether Article 27 applies

Record the deployer, system classification, public or private service context, affected decision and any relevant exception. Preserve the basis for deciding that a FRIA is required, not required or needs qualified review.

Deployer and system role
High-risk category and intended purpose
Public body or essential-service context
Existing assessment and material-change status

2. Describe use and affected people

Document the process in which the system is used, frequency and duration, categories of natural persons and groups potentially affected, reasonably foreseeable harms and the rights that may be engaged.

3. Record safeguards and governance

Describe human oversight, instructions, competence, complaint and redress routes, monitoring, incident response, data-protection links and measures for identified risks.

Oversight authority and intervention points
Affected-person information
Complaint and remedy route
Monitoring indicators and escalation
Relationship to the DPIA where relevant

4. Approve, notify and revisit

Freeze the reviewed assessment, retain qualified input and record any notification step. Reassess when the intended purpose, affected population, model, data, autonomy or deployment conditions materially change.

Recommended next step

Use a controlled FRIA readiness record to gather the facts, then send the frozen scope for qualified review where applicability or proportionality is uncertain.

Run the free exposure check

Related practical guides

Annex III high-risk AI systems explainedA practical guide to identifying potential Annex III high-risk AI use cases and documenting the facts needed for expert review.EU AI Act deployer documentation packOrganise the records an AI deployer may need across instructions, oversight, logs, monitoring, incidents, FRIA, privacy and worker information.EU AI Act evidence and documentation planTurn EU AI Act obligations into an evidence plan with owners, review dates, versions, approvals and secure storage choices.EU AI Act provider vs deployer rolesUnderstand the practical difference between provider and deployer roles under the EU AI Act and why one company can hold different roles.

Put the guidance into practice

Risk and incident managementConnect fundamental-rights facts to controls, monitoring and reassessment.