What Article 27 requires
Before putting certain high-risk systems into use, in-scope deployers must finish a fundamental rights impact assessment (FRIA), record the mandatory assessment elements, and notify the market surveillance authority with a detailed summary. The assessment is not a one-time filing: it must be updated when relevant factors change, and its safeguards should map to how the system actually runs in production.
Applicability turns on both the risk classification of the system and the nature of the deployer. Bodies governed by public law, private entities that provide public services, and deployers of Annex III points 5(b) and 5(c) systems fall in scope. High-risk systems intended for Annex III point 2 are excluded from this Article 27 duty, so the exclusion check belongs in the applicability record.
Applicability and scope checklist
Use a written applicability decision before go-live. The decision should state why Article 27 applies (or does not), which deployer category is involved, and whether the Annex III point 2 exclusion is relevant.
- Applicability decision documented for public-law body, private public-service provider, or Annex III 5(b)/(c), including Annex III point 2 exclusion check
- FRIA dossier completes every Article 27(1) minimum element and is aligned to intended purpose
- Human oversight, escalation, complaint, and risk-materialisation measures are named and operationally owned
- DPIA gap analysis shows complementary fundamental-rights coverage where a DPIA already exists
- Detailed FRIA summary and market surveillance authority notification workflow are complete with retained evidence
- Runtime access, tool permissions, logging, monitoring, and update triggers are mapped to FRIA safeguards
Article 27 FRIA operating loop
Treat FRIA as a closed loop from gatekeeping through production evidence, not as a standalone policy document. The following sequence keeps legal obligations connected to operational controls.
- Applicability gate Confirm Article 6(2) high-risk status, deployer category, and Annex III point 2 exclusion before go-live.
- FRIA dossier Capture process context, affected groups, harm risks, oversight, and response measures in a reusable template.
- Notification record Produce the detailed summary and evidence of market surveillance authority notification.
- Runtime evidence Enforce and log access limits, oversight actions, monitoring signals, and FRIA updates in production.
Binding FRIA outputs to production controls
Documentation alone does not demonstrate compliance readiness. FRIA conclusions should drive inventory records, access boundaries, oversight design, monitoring inputs, and retained evidence packages that match the live configuration.
Bind inventory to intended purpose
Link FRIA affected groups, harm scenarios, and process descriptions to the high-risk classification and intended-purpose record used for Article 6(2) and Annex III decisions. When purpose, population, or process context drifts, the inventory entry and the FRIA should move together.
Enforce least-privilege operation
Map who may initiate, approve, or override system actions to identity, permissions, and tool boundaries that match FRIA use conditions and frequency limits. Runtime permissions should reflect the assessed operating envelope, not a broader technical capability of the platform.
Make Article 14 oversight observable
Ensure human oversight roles can intervene, escalate, and stop use, and that those actions are logged with enough context to reconstruct decisions. Named ownership for escalation, complaint handling, and risk-materialisation response should be visible in both the dossier and the operating runbooks.
Monitor for FRIA update triggers
Use performance drift, serious-incident signals, complaint intake, and purpose or population changes as inputs that reopen the assessment. Update triggers belong in monitoring design so re-assessment is event-driven rather than ad hoc.
Prove DPIA complementarity
Where a GDPR DPIA already exists, document which Article 27(1) elements were reused and which fundamental-rights elements were newly assessed. The goal is complementary coverage, not duplicate paperwork that leaves FRIA-specific harms unaddressed.
Retain audit-ready packages
Keep FRIA versions, notification summaries, logs under deployer control, oversight decisions, and change records aligned to the live system configuration. Evidence should show what was assessed, what was notified, and how safeguards operated over time.
Implementation focus
Strong Article 27 programs connect four artifacts: the applicability decision, the complete FRIA dossier, the authority notification package, and runtime records that show safeguards were enforced after deployment.
Control mapping reference
The table below summarizes how common FRIA outputs translate into operational control areas without prescribing a single tooling stack.
| FRIA output | Operational control area | Evidence to retain |
|---|---|---|
| Affected groups and harm scenarios | Intended purpose, inventory classification, monitoring scope | Linked inventory record and assessment version |
| Use conditions and frequency limits | Identity, permissions, tool boundaries | Access policy and runtime permission logs |
| Human oversight and escalation | Article 14 intervention, stop-use, complaint paths | Oversight actions and decision context logs |
| Risk-materialisation measures | Incident response, serious-incident signals | Incident tickets and FRIA update records |
| DPIA reuse analysis | Gap analysis against Article 27(1) elements | Crosswalk of reused vs newly assessed items |
| Detailed summary for notification | Market surveillance authority workflow | Submitted summary and notification proof |
Putting it together
Article 27 is workable when deployers treat the FRIA as an operating design input. Confirm scope early, complete every mandatory assessment element against intended purpose, notify with a detailed summary, and keep the assessment current as systems and populations change. Then prove that access limits, oversight, logging, and monitoring in production still match the safeguards written in the dossier.