European UnionAI Act, Article 27 (fundamental rights impact assessment)
Regulation (EU) 2024/1689, Article 27
An AI risk obligations rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- DPIA
- Audit expectation
- none
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, the only classification this duty reaches, so the later date of for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- If you are a body governed by public law, a private entity providing a public service, or a deployer of a credit-scoring or life-and-health-insurance-risk-pricing high-risk AI system (Annex III points 5(b) or (c)), assess the impact on fundamental rights of a high-risk AI system before its first use, unless the system is the Annex III point 2 critical-infrastructure use case.NIST AI RMFMAP 5.1
- Cover in that assessment: your intended process for using the system, the period and frequency of use, the categories of people likely affected, the specific risks of harm to them, your human oversight measures, and the steps you would take if those risks materialise, including complaint and internal-governance arrangements.NIST AI RMFMAP 1.1
- Update the assessment if any of those elements changes during use, rather than treating it as a one-time exercise.NIST AI RMFMAP 5.1
- Once you have performed the assessment, notify the market surveillance authority of its results using the AI Office's template, unless you are exempt, which Article 27(3) allows in the case referred to in Article 46(1), where a market surveillance authority has authorised the system for exceptional reasons such as public security or the protection of life and health.NIST AI RMFGOVERN 1.1
- If a data protection impact assessment you already owe under the General Data Protection Regulation (GDPR) or the Law Enforcement Directive covers part of this assessment, let this one complement rather than duplicate it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 1.1Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related TEVV and system metrics.
- MAP 5.1Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- NIST AI 200-2 Draft
- 2.4Synthesize & Interrogate
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Settledness
- As of
- Open questions
- Does 'private entities providing public services' in Article 27(1) reach a private operator of a utility, a bank or an insurer, given that deployers of systems under points 5(b) and (c) of Annex III are named separately in the same paragraph?
- Does a provider's update to a high-risk AI system require a new fundamental rights impact assessment under Article 27(2), which applies the obligation to 'the first use' and lets the deployer rely on previous assessments 'in similar cases'?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Affected person reference, Decision basis
Logging duty
Article 27 does not use the words log or record. The assessment is a document the deployer performs before first use, may reuse in similar cases and updates when a described element changes (paragraph 2), and sends to the market surveillance authority with the AI Office's template (paragraph 3); that cannot be done without a retained record, so the duty is implicit. The assessment is not a per-event entry. Its nearest fit to log content is a reference to the affected people for point (c) of paragraph 1, the categories of people likely to be affected, and the basis of the decision for the risk and mitigation descriptions in points (d) and (f); the article itself names neither.
- Kind
- Implicit
- As of
- Provision
- Article 27(1) and (3)
- Trigger
- high_risk_systems
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Before deploying a high-risk AI system classified under Article 6(2), other than an Annex III point 2 (critical infrastructure) system, a deployer that is a body governed by public law, a private entity providing a public service, or a deployer of an Annex III point 5(b) or (c) system (creditworthiness or life and health insurance risk assessment) must assess the impact the system's use may have on fundamental rights.
That assessment covers the deployer's intended process, the period and frequency of use, the categories of people likely affected, the specific risks of harm to them, the human oversight measures in place, and the measures planned if those risks materialise, including complaint and internal-governance arrangements. The assessment is required on first use, may draw on a similar prior assessment, and must be updated if a described element changes.
Once performed, the deployer must notify the market surveillance authority of the results on the AI Office's template, with a possible exemption in the case referred to in Article 46(1), where a market surveillance authority has authorised a specific high-risk AI system to be placed on the market or put into service for exceptional reasons such as public security or the protection of life and health; and where the deployer's data protection impact assessment under Article 35 General Data Protection Regulation (GDPR) or Article 27 of the Law Enforcement Directive already covers an element of this assessment, this one only needs to complement it.
Article 27 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III. Article 27 reaches only a high-risk AI system referred to in Article 6(2), so the later date in that schedule for a system classified under Article 6(1) and Annex I brings no further system within it.
Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 27 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .