Fundamental rights impact assessment (Art. 27 AI Act)

Who has to carry out a fundamental rights impact assessment?

Article 27(1) AI Act places the obligation on deployers of a high-risk AI system under Art. 6(2) (Annex III), namely:

• bodies governed by public law, such as municipalities, state (Land) authorities, and public corporations such as health insurers or professional chambers,
• private bodies providing public services, according to the recitals for example in education, healthcare, social services or housing,
• deployers of systems under Annex III point 5(b) and (c): creditworthiness and pricing of life and health insurance.

Systems for critical infrastructure (Annex III point 2) are excluded. The abbreviation is FRIA (Fundamental Rights Impact Assessment).

When does the obligation apply?

Article 27 is one of the high-risk obligations in Chapter III. Following the amendment by Regulation (EU) 2026/1744, these apply to systems under Annex III from 2 December 2027. Public authorities that already use such a system before then must bring it into line with the Regulation by 2 August 2030 at the latest (Art. 111(2)).

What goes into it?

Article 27(1) lists six elements:

Element	Content
a	Description of the processes in which the system is used in line with its intended purpose
b	Period and frequency of use
c	Groups of people who may be affected
d	Specific risks to these groups, using the provider’s information under Art. 13
e	How human oversight is implemented according to the instructions for use
f	Measures if risks materialise, including internal responsibilities and complaint mechanisms

You notify the result to the market surveillance authority (para. 3); in Germany this is generally the Federal Network Agency (Bundesnetzagentur). The Commission’s AI Office provides a questionnaire for this, which after the Digital Omnibus is expressly also available as an automated tool (para. 5).

How does it relate to the DPIA?

The data protection impact assessment under Art. 35 GDPR examines the risks of data processing; the fundamental rights impact assessment examines all fundamental rights: equal treatment, access to services, human dignity, effective remedy. The two overlap. Since the Digital Omnibus, you may refer to an existing DPIA in the fundamental rights impact assessment or take over parts of it (Art. 27(4)). In practice, this means one document with two parts, maintained jointly by data protection and the specialist department. More on the DPIA in the guide DPIA for AI.

How do you prepare?

1. Sort your uses: Which AI applications fall under Annex III, and which do not? Help: Identifying high-risk AI.
2. Ask the provider: The instructions for use under Art. 13 provide the basis for elements d and e.
3. Involve those affected: the specialist department, data protection, equal opportunities, the staff council or works council and, where appropriate, advisory boards.
4. Define oversight and complaint mechanisms: Who checks results, who can object, how are adjustments made?

How does this work with basebox?

basebox is a platform, not a high-risk system. For general tasks such as drafts, summaries and questions about documents, no fundamental rights impact assessment is therefore required. For the data protection impact assessment, Security offers templates for the cloud and the server, structured according to Art. 35 GDPR and the Standard Data Protection Model (Standard-Datenschutzmodell, the German supervisory authorities’ method); the details about basebox are already filled in.

Not legal advice: As of 11 October 2026. The Commission’s questionnaire and the guidelines on classifying high-risk AI may further specify the requirements.