European UnionAI Act, Article 27 (fundamental rights impact assessment)
Regulation (EU) 2024/1689, Article 27
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
An AI risk obligations rule binding public and private bodies.
As of 24 September 2026.
What it requires
- This duty does not yet apply. It takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I.
- If you are a body governed by public law, a private entity providing a public service, or a deployer of a credit-scoring or life-and-health-insurance-risk-pricing high-risk AI system (Annex III points 5(b) or (c)), assess the impact on fundamental rights of a high-risk AI system before its first use, unless the system is the Annex III point 2 critical-infrastructure use case.
- Cover in that assessment: your intended process for using the system, the period and frequency of use, the categories of people likely affected, the specific risks of harm to them, your human oversight measures, and the steps you would take if those risks materialise, including complaint and internal-governance arrangements.
- Update the assessment if any of those elements changes during use, rather than treating it as a one-time exercise.
- Once you have performed the assessment, notify the market surveillance authority of its results using the AI Office's template, unless you are exempt as a real-world testing participant under Article 46(1).
- If a data protection impact assessment you already owe under the General Data Protection Regulation (GDPR) or the Law Enforcement Directive covers part of this assessment, let this one complement rather than duplicate it.
If you get it wrong
Private right of actionNo
What it reaches
How the hook was established
express
What makes it apply
Operator establishment, Place of effect
Obligation class
DPIA
What it makes you log
Who may demand the log
Regulator
What the log must hold
Affected person reference, Decision basis
Logging duty
The fundamental rights impact assessment is itself the record: the deployer performs and keeps it, updates it when a described element changes, and notifies the market surveillance authority of its results using the AI Office's template.
- Kind
- Explicit
- As of
- 24 September 2026
- Provision
- Article 27(1) and (3)
- Trigger
- high_risk_systems
Who checks it
Audit expectation
none
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Before deploying a high-risk AI system classified under Article 6(2), other than an Annex III point 2 (critical infrastructure) system, a deployer that is a body governed by public law, a private entity providing a public service, or a deployer of an Annex III point 5(b) or (c) system (creditworthiness or life and health insurance risk assessment) must assess the impact the system's use may have on fundamental rights.
That assessment covers the deployer's intended process, the period and frequency of use, the categories of people likely affected, the specific risks of harm to them, the human oversight measures in place, and the measures planned if those risks materialise, including complaint and internal-governance arrangements. The assessment is required on first use, may draw on a similar prior assessment, and must be updated if a described element changes.
Once performed, the deployer must notify the market surveillance authority of the results on the AI Office's template, with a narrow real-world-testing exemption; and where the deployer's data protection impact assessment under Article 35 General Data Protection Regulation (GDPR) or Article 27 of the Law Enforcement Directive already covers an element of this assessment, this one only needs to complement it.
Article 27 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for one classified under Article 6(1) and Annex I.
When LexLint raises it
high_risk_decisions
Read the law
official consolidated Official Journal text, EUR-Lex
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.