Introduction: a specific duty for deployers of high-risk AI
Article 27 of Regulation (EU) 2024/1689, the EU AI Act, sets a specific requirement for deployers of certain high-risk artificial intelligence systems. Unlike provider duties focused on a system’s design and technical risk management, this requirement falls on the organisation that uses the system under its own authority.
A fundamental rights impact assessment (FRIA) is not merely an administrative formality. It is a preventive safeguard: before the first use, the deployer must consider how the system may affect individuals and groups in its actual context, and set out the human oversight and response measures needed if risks arise.
Legal scope: who must carry out a FRIA
Article 27(1) applies before deployment of a high-risk AI system covered by Article 6(2), subject to an exception for systems intended for use in the critical-infrastructure area listed in Annex III, point 2. The duty is not imposed on every deployer of every high-risk system.
The covered deployers are public-law bodies and private entities providing public services, in relation to the relevant Annex III systems other than the specified critical-infrastructure systems. The duty also applies to deployers of high-risk systems in Annex III, point 5(b) and (c): systems used to evaluate the creditworthiness of natural persons or establish their credit score, and systems used for risk assessment and pricing in relation to life and health insurance for natural persons. These categories should be checked against the applicable legal text and the system’s intended use; the label used by an organisation is not decisive.
Deployers covered by Article 27
The categories below summarise the scope set out in Article 27(1).
| Deployer category | High-risk systems covered |
|---|---|
| Public-law bodies | Systems covered by Article 6(2), except systems intended for the critical-infrastructure area in Annex III, point 2 |
| Private entities providing public services | Systems covered by Article 6(2), except systems intended for the critical-infrastructure area in Annex III, point 2 |
| Any deployer, regardless of whether it provides a public service | Systems within Annex III, point 5(b) and (c): creditworthiness or credit scoring for natural persons, and life or health insurance risk assessment and pricing |
What the assessment must contain
Article 27(1) lists six elements that the assessment must address. They are statutory requirements, not merely examples of good practice. The assessment must be tied to the specific use context rather than relying on a generic statement about the system or its intended purpose.
In practice, the deployer needs to explain the operational processes in which the system will be used, the expected duration and frequency of use, and which people or groups may be affected. It must then identify the specific risks of harm to those groups, taking account of information supplied by the provider under Article 13, describe how human oversight will be applied in line with the instructions for use, and specify what will happen if the risks materialise. The response measures must include internal governance arrangements and complaint mechanisms.
Mandatory elements under Article 27(1)
A compliant assessment must address each of the following points in the context of the intended deployment.
- 01Describe the deployer’s processes in which the high-risk AI system will be used, consistently with its intended purpose.
- 02State the expected period of use and how frequently the system is expected to be used.
- 03Identify the categories of natural persons and groups that may be affected in the specific context.
- 04Assess the specific risks of harm to those people and groups, taking account of the information provided by the provider under Article 13.
- 05Describe how human oversight measures will be applied in accordance with the instructions for use.
- 06Set out the measures to take if the risks materialise, including internal governance arrangements and complaint mechanisms.
How the FRIA differs from provider risk management
A FRIA under Article 27 should not be confused with a provider’s risk-management system under Article 9. The provider’s system identifies, analyses and mitigates risks associated with the high-risk AI system. Article 27 instead requires specified deployers to assess the possible fundamental-rights impact of using that system in their particular organisational and operational context.
The deployer should use the provider’s information, including the information supplied under Article 13, but cannot transfer its own Article 27 responsibility to the provider. The assessment is required before the first use. In similar cases, the deployer may rely on a previous FRIA or an existing impact assessment carried out by the provider. That option does not remove the need to make sure the assessment addresses the current deployment. If an element changes or becomes outdated during use, the deployer must take the necessary steps to update the information.
Provider risk management and deployer FRIA
The two duties have different responsible parties, purposes and outputs.
| Criterion | Article 9: provider | Article 27: deployer |
|---|---|---|
| Responsible party | Provider of the high-risk AI system | Deployer using the system under its own authority |
| Main focus | Risks associated with the system and their management | Impact that use in a specific context may have on fundamental rights |
| Timing | Risk management as part of the system’s lifecycle | Before first use; information must be updated when relevant elements change or become outdated |
| Information and output | Provider-side risk-management measures and related system information | Context-specific assessment, including affected groups, human oversight and response measures; results are notified to the market-surveillance authority, subject to the statutory exception |
Practical implementation and records
Article 27 applies to the first use of the high-risk AI system. It also requires the deployer to keep the assessment’s information current: if, while using the system, the deployer considers that one of the listed elements has changed or is no longer up to date, it must take the necessary steps to update it. This makes it sensible to connect the assessment to operational change management and periodic review, while distinguishing that recommended practice from the precise statutory trigger.
After completing the assessment, the deployer must notify its results to the market-surveillance authority and submit the completed questionnaire template referred to in Article 27(5). Article 27(3) provides an exception to that notification duty in the case covered by Article 46(1). The assessment should therefore be documented in a way that makes its scope, reasoning, information sources, decisions and updates intelligible, but Article 27 does not prescribe a separate, exhaustive evidence file beyond its stated requirements and the applicable notification process.
Supervision, complaints and response to harm
Human oversight is one of the six elements that Article 27 expressly requires the FRIA to describe. The description must reflect how oversight will actually operate in the deployment and must be consistent with the system’s instructions for use. A general commitment to “human review” is not enough to explain how the required measure will be applied in the relevant process.
The assessment must also state what measures will be taken if identified risks materialise, including internal governance arrangements and complaint mechanisms. Operationally, this means documenting who receives a concern, who can pause or change the use, how affected people can raise complaints, and how the organisation will decide and record follow-up action. These examples are implementation practices for making the statutory requirements workable, not additional items expressly enumerated in Article 27.
Penalties and consequences of non-compliance
Failure to comply with Article 27 is a failure to meet an obligation imposed on deployers of high-risk AI systems. Article 99 sets the applicable administrative-fine framework for breaches of the AI Act, with the applicable level depending on the provision breached and the circumstances.
The proposal’s blanket statement that any Article 27 breach attracts a maximum of €15 million or 3% of worldwide annual turnover should not be treated as verified without checking the applicable, current wording of Article 99 and the specific classification of the infringement. The evidence provided here establishes Article 27’s duties but does not set out the relevant Article 99 penalty text in sufficient detail to confirm that precise ceiling. Organisations should verify the current consolidated regulation before quoting a maximum fine. Any applicable SME rule and the treatment of public authorities should likewise be checked against that text.
Application dates, limitations and practical checklist
The source material identifies the AI Act Service Desk of the European Commission as providing a consolidated text based on the version available on 27 July 2026, including amendments marked as changes to the original regulation. The supplied evidence does not establish a definitive application date for Article 27 in light of those amendments. The original Article 113 timetable and any later amendments must therefore be checked in the current consolidated legal text before giving an operative date; this guide does not present an unverified date as settled.
Article 27 itself is detailed about the assessment’s required content, but its practical execution also depends on the questionnaire template to be prepared by the AI Office. The available evidence does not establish whether that template is publicly available or confirm the status of further Commission guidance. Until those points are checked against current official material, organisations can use the statutory list below as a compliance checklist, clearly separating legal duties from additional internal controls.
Article 27 checklist: legal duties and recommended controls
The first six steps reflect Article 27’s stated requirements. The final two are recommended controls to help keep the assessment usable and current.
- 01Legal duty: determine whether the organisation is a covered deployer and whether the system and use fall within Article 27(1), including the relevant exception and Annex III categories.
- 02Legal duty: complete the assessment before the first use of the covered high-risk system.
- 03Legal duty: describe the operational processes, expected period and frequency of use, and affected categories of people and groups.
- 04Legal duty: assess specific risks of harm, taking account of the provider information required under Article 13.
- 05Legal duty: describe human oversight in line with the instructions for use and specify measures if risks materialise, including internal governance and complaint mechanisms.
- 06Legal duty: notify the market-surveillance authority of the assessment results using the completed Article 27(5) template, unless the Article 46(1) exception applies; consider permitted references to a GDPR or law-enforcement data-protection impact assessment.
- 07Recommended control: record the assessment’s owner, approval, sources, assumptions and rationale so decisions can be reviewed and explained.
- 08Recommended control: connect review of the assessment to changes in the system, deployment process, affected population or identified risks, and update information when Article 27(2) requires it.
Open questions
- The supplied evidence does not establish a definitive Article 27 application date after any amendments to the AI Act; check the current consolidated text and applicable transitional provisions before relying on a date.
- The available evidence does not confirm whether the AI Office questionnaire template under Article 27(5) has been published or establish the status of further Commission guidance.
- The supplied material does not provide enough of the current Article 99 text to verify a specific fine ceiling for an Article 27 breach; do not rely on the proposed €15 million or 3% figure without checking the current provision.
- The regulation permits reliance on prior assessments in similar cases, but the evidence provided does not resolve every practical question about how much adaptation is needed for a new deployment context.
Keep exploring
Sources consulted
Corrections and transparency
If you spot incorrect or outdated information, send us a correction with the page and source we should review.
Submit a correction