Fundamental rights
EU AI Act FRIA template and readiness checklist
A Fundamental Rights Impact Assessment is a structured examination of how certain high-risk AI deployments may affect people. The first task is to establish applicability; the second is to gather facts without turning the template into an automatic legal conclusion.
Prepared by EU AI Fit editorial team · Published 24 August 2026 · Source review 31 August 2026 · Page updated 24 September 2026
1. Screen whether Article 27 applies
Record the deployer, system classification, public or private service context, affected decision and any relevant exception. Preserve the basis for deciding that a FRIA is required, not required or needs qualified review.
- Deployer and system role
- High-risk category and intended purpose
- Public body or essential-service context
- Existing assessment and material-change status
2. Describe use and affected people
Document the process in which the system is used, frequency and duration, categories of natural persons and groups potentially affected, reasonably foreseeable harms and the rights that may be engaged.
3. Record safeguards and governance
Describe human oversight, instructions, competence, complaint and redress routes, monitoring, incident response, data-protection links and measures for identified risks.
- Oversight authority and intervention points
- Affected-person information
- Complaint and remedy route
- Monitoring indicators and escalation
- Relationship to the DPIA where relevant
4. Approve, notify and revisit
Freeze the reviewed assessment, retain qualified input and record any notification step. Reassess when the intended purpose, affected population, model, data, autonomy or deployment conditions materially change.
Check the legal boundary before filling the form
Article 27 is not a universal requirement for every AI deployment. Its scope depends on the system category and deployer, including specified public-service and credit or insurance contexts and an exclusion for the relevant critical-infrastructure category. Obtain a current applicability decision rather than relying on the broad label ‘essential service’. Record amendments, exceptions and commencement separately.
In this scenario: reviewing an allocation recommendation
A public-service team is considering an assistant that recommends the order in which cases are handled. Start with the actual influence of the recommendation: who waits longer, whether staff see omitted cases, how errors are detected and how a person can challenge the outcome. A privacy assessment may contribute relevant facts, but it does not automatically answer the wider rights questions. Keep unresolved applicability and safeguard questions with the reviewer rather than labelling a completed worksheet ‘approved’.
- Use aggregated or hypothetical examples in broadly shared working copies.
- Invite relevant operational and affected-person perspectives where appropriate.
- Treat a change in population, purpose or decision influence as a reason to revisit the record.
FRIA readiness working sheet
This is an EU AI Fit fact-gathering aid, not the AI Office notification template or a substitute for a qualified assessment. Record supporting evidence and unresolved questions before approval or any required notification.
Download editable worksheet (CSV)No email or account required. Includes response, evidence, owner, review and follow-up columns for your team. This is a working aid, not an official form or proof of compliance.
On smaller screens, scroll the table horizontally or download the worksheet.
| Review area | Facts to enter | Decision or evidence needed |
|---|---|---|
| Applicability | Deployer, role, intended purpose, classification and service context | Current legal basis, exception analysis, reviewer and applicable date |
| Operating process | Where the output enters a decision and who may rely on it | Process diagram and provider instructions |
| Frequency and period | How often, for how long, and at what scale the system is used | Deployment plan and boundaries |
| People affected | Groups affected directly or indirectly; accessibility and vulnerability considerations | Evidence for inclusion of groups and known information gaps |
| Possible harm | How a system or human-process failure could affect those groups | Scenario, severity, likelihood reasoning and uncertainty |
| Human oversight | Who checks, intervenes or stops use and what information they receive | Authority, instructions, capacity and rehearsal evidence |
| Safeguards and remedy | Preventive measures, complaints, escalation and response if harm occurs | Owner, operating test and unresolved residual concern |
| Linked assessments | Relevant privacy, security and other impact assessments | What is reused and what this assessment still needs to address |
| Decision and notification | Approver, conditions, advice, authority and notification assessment | Controlled version; required submission evidence where applicable |
| Reassessment | Changes that would invalidate the facts or safeguards | Owner, review date and event-driven triggers |
Recommended next step
Use a controlled FRIA readiness record to gather the facts, then send the frozen scope for qualified review where applicability or proportionality is uncertain.
Run the free exposure checkRelated practical guides
Put the guidance into practice