What is the FRIA?
Art. 27 EU AI Act requires an assessment of the impact on fundamental rights before certain high-risk AI systems are deployed. The FRIA complements a data protection impact assessment, but does not automatically replace it.
Who must carry out a FRIA in the financial sector?
Under Art. 27, mainly deployers of high-risk AI under Annex III 5(b) and 5(c): AI for creditworthiness assessment of natural persons and for risk assessment and pricing in life and health insurance.
| Annex III | Area | Typical systems |
|---|---|---|
| 5(b) | Access to essential private and public services | AI-supported creditworthiness assessment of natural persons, credit scoring, decision support for loan applications |
| 5(c) | Life and health insurance | AI-supported risk assessment and pricing for natural persons |
| 4 | Employment | HR AI is high-risk relevant; whether private financial institutions have a FRIA obligation must be assessed separately under Art. 27. |
What must a FRIA under Art. 27 contain?
Seven elements, from the process description and period of use through risks and human oversight to notifying the market surveillance authority.
- description of the processes in which the AI system is used
- duration and frequency of use
- categories of affected natural persons and groups
- specific fundamental-rights risks in the concrete context
- human oversight measures
- measures if a risk materialises
- after completion: notification of the results to the market surveillance authority using the envisaged template, unless an exemption applies
Which fundamental rights does AI in financial services touch most?
Four in particular: non-discrimination, data protection, effective remedy, and human dignity and fair treatment.
| Fundamental right | Typical relevance |
|---|---|
| Non-discrimination | Bias in credit, pricing, underwriting or HR processes |
| Protection of personal data | Financial data, health data, creditworthiness data and profiling |
| Right to an effective remedy | Traceability and contestability of AI-supported decisions |
| Human dignity and fair treatment | Avoidance of degrading or fully uncontrolled decisions |
How are FRIA and DPIA coordinated?
Separately, but aligned. Where personal data is processed and a high risk to individuals exists, a data protection impact assessment under Art. 35 GDPR must also be assessed. Art. 27 EU AI Act expressly provides that the FRIA complements a DPIA; where elements are already covered by a DPIA, they can be referenced. FRIA and DPIA nevertheless remain distinguishable assessments. In practice, a shared analysis process with separately traceable outcomes is sensible.
When must the FRIA be carried out?
The FRIA must be carried out before the first use of the relevant high-risk AI system and updated if key elements change or are no longer current. For the Annex III cases covered here, the Art. 27 duty applies from 2 December 2027 (Regulation (EU) 2026/1744). For high-risk systems put into service before that date, the transitional rule in Art. 111(2) must be assessed separately. A voluntary, early FRIA is a sensible preparation, but it should be distinguished from a legal duty that is already due; for systems already in use it should be included in the AI governance roadmap.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).