Article 27: Fundamental Rights Impact Assessment (FRIA)
Article 27 requires certain deployers — public-sector bodies, private operators of essential public services, and deployers of specific Annex III systems such as creditworthiness assessment and life/health insurance risk pricing — to carry out a Fundamental Rights Impact Assessment before first using a high-risk system, and to notify the market surveillance authority. A GDPR data protection impact assessment can be credited toward this duty but does not automatically satisfy it.
- 02 Dec 2027 Derived date, coupled to the Annex III high-risk applicability date; not confirmed by a primary source specific to Article 27
- Determine whether the deployer falls into the addressee group: public-sector body, private operator of an essential public service, or deployer of specific Annex III categories such as creditworthiness or insurance risk systems.
- Carry out the FRIA before first use of the qualifying high-risk system, assessing impacts on affected persons' fundamental rights.
- Notify the market surveillance authority of the assessment outcome.
- Where a GDPR data protection impact assessment already exists, use it as a documented input but confirm it covers all elements the FRIA requires.
- Update the assessment when the context of use changes materially.
- FRIA document
- Notification record to the market surveillance authority
- Referenced GDPR DPIA, if credited
A GDPR DPIA is often assumed to automatically satisfy the FRIA requirement; it can be credited toward it, but the FRIA has its own scope (fundamental rights broadly, not only data protection) and its own narrower addressee list.
Unsettled: Whether the FRIA deadline explicitly moved to 2 December 2027 along with the rest of Annex III, or is governed by its own timing, was not confirmed by any primary source found in the underlying research — the 2 December 2027 date here is a logical inference from Article 27's link to Annex III applicability, not a directly verified fact.
What regulators published on Art. 27
- Loading from the public feed…
- Regulation (EU) 2024/1689 on EUR-Lex
- Look for Article 27
- Deadline changes and the acts behind them
Get told when Art. 27 moves.
Deadlines under this regulation have already shifted once in 2026. A signed webhook, a REST API and an MCP server carry the same record this page is built from, so your systems learn about the next change without anyone re-reading the text. Free during the beta.
Get free accessInformational content only. Not legal advice and not a substitute for qualified counsel. Dates reflect Regulation (EU) 2026/1744 as of 04 Aug 2026.