AI Governance Engineer
GitHub

EU AI Act Art. 27: Fundamental Rights Impact Assessment (FRIA)

Fundamental Rights Impact Assessment (FRIA) for deployers of Annex III systems

By Reviewed

From clause to evidenceThe chain from EU AI Act Art. 27 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: EU AI Act (post-Omnibus), Art. 27ClauseEU AI ActArt. 27Duty holder: DeployerDuty holderDeployerApplies from: 2027-12-02 (Deferred)Applies from2027-12-02DeferredArtefact: FRIA-as-code from a template; cross-reference to a GDPR Art. 35 DPIAArtefactFRIA-as-codefrom a templateLayers: Layer 01 Govern-as-Code and Layer 02 Inventory & TransparencyLayersLayer 01Layer 02Evidence record: Impact assessment, Deployment decision record, Use-case recordEvidence recordImpactassessment+2 moreSame topic in 13 frameworks (22 clauses): ISO 42001, NIST AI RMF, TC260 Framework 3.0, China GenAI Measures, GDPR, ISO42005, CSA AICM and 6 moreAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from EU AI Act Art. 27 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: EU AI Act (post-Omnibus), Art. 27ClauseEU AI Act · Art. 27Duty holder: DeployerDuty holderDeployerApplies from: 2027-12-02 (Deferred)Applies from2027-12-02 · DeferredArtefact: FRIA-as-code from a template; cross-reference to a GDPR Art. 35 DPIAArtefactFRIA-as-code from a templateLayers: Layer 01 Govern-as-Code and Layer 02 Inventory & TransparencyLayersLayer 01Layer 02Evidence record: Impact assessment, Deployment decision record, Use-case recordEvidence recordImpact assessment · +2 moreSame topic in 13 frameworks (22 clauses):ISO 42001, NIST AI RMF, TC260 Framework 3.0,China GenAI Measures, GDPR and 8 moreAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-EUAIA-ART27. Drawn from chapter 08.
Text alternative
  • Clause: EU AI Act, Art. 27.
  • Duty holder: Deployer.
  • Applies from: 2027-12-02, Deferred.
  • Artefact: FRIA-as-code from a template.
  • Layers: Layer 01, Layer 02.
  • Evidence record: Impact assessment, +2 more.
  • Record schemas: Impact assessment , Deployment decision record , Use-case record .
  • The same topic in 13 other frameworks; the crosswalk section below links each clause.
When this obligation applies2 dates of AIGE-OBL-EUAIA-ART27 on a time axis, against its review date 2026-09-24.2024202620282030As of 2026-09-242027-12-02 · DeferredAnnex III2030-08-02 · Later stepDeadline for legacy high-risksystems intended for use bypublic authorities (Art.111(2))2027-12-02 · Deferred · Annex III2030-08-02 · Later step · Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Source: Obligation register(chapter 08)
When this obligation applies2 dates of AIGE-OBL-EUAIA-ART27 on a time axis, against its review date 2026-09-24.2027-12-02 · DeferredAnnex III2030-08-02 · Later stepDeadline for legacy high-risk systemsintended for use by public authorities (Art.111(2))2024202620282030As of 2026-09-242027-12-02 · Deferred · Annex III2030-08-02 · Later step · Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Source: Obligation register (chapter 08)
When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.
Data table: the dates
Dates of AIGE-OBL-EUAIA-ART27
DateStepDetail
2027-12-02DeferredAnnex III
2030-08-02Later stepDeadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))
Id
AIGE-OBL-EUAIA-ART27
Instrument
EU AI Act (post-Omnibus) law
Compared side by side
ISO 42001 vs EU AI Act · NIST AI RMF vs EU AI Act
Clause
Art. 27
Duty holder
Deployer
Authority
National MSA
Applies from
Deferred · Annex III
Later dates
  • Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))
System class
High-risk (Annex III)

The artefact that evidences it

FRIA-as-code from a template; cross-reference to a GDPR Art. 35 DPIA.

What this obligation connects toEU AI Act Art. 27 and its 17 relations: 2 patterns, 2 cases, 13 same crosswalk topic.DirectLooserColour: stack layer of the pattern or control01 Govern-as-Code02 InventoryEU AI Act Art. 27Patterns (2)FRIA-as-Code · DirectFRIA-as-CodeVendor / Model Due-Diligence Gate · DirectVendor / Model Due-Diligence…Cases (2)Dutch childcare benefits: nationality as a risk indicator · Cites the articleDutch childcare benefitsSyRI: a fraud risk model no court could verify · Cites the articleSyRI judgmentSame crosswalk topic (13)AI Verify 11.2.1, 4.2.1 · Core clauseAI VerifyCSA AICM GRC-10, DSP-09 · Core clauseCSA AICMChina GenAI Measures GenAI Art. 17 · Core clauseChina GenAI MeasuresGDPR Art. 35, Art. 36 · Core clauseGDPRISO 42001 6.1.4, 8.4, A.5 · Core clauseISO 42001ISO 42005 42005 5.8, 42005 6.8, 42005 5.12 · Core clauseISO 42005+7 more+7 more: Korea AI Act Art. 35, NIST AI RMF MAP 3, MAP 5, TC260 Framework 3.0 TC260 Appendix 1, TC260 2.2, UK ATRS ATRS 2.5.1, CoE Convention CoE Art. 16, EU AI Act Art. 9, GAO AI Accountability 1.5
What this obligation connects toEU AI Act Art. 27 and its 17 relations: 2 patterns, 2 cases, 13 same crosswalk topic.DirectLooserColour: stack layer of the pattern or control01 Govern-as-Code02 InventoryPatterns (2)FRIA-as-Code · DirectFRIA-as-CodeVendor / Model Due-Diligence Gate · DirectVendor / Model Due-Diligence…Same crosswalk topic (13)AI Verify 11.2.1, 4.2.1 · Core clauseAI VerifyCSA AICM GRC-10, DSP-09 · Core clauseCSA AICMChina GenAI Measures GenAI Art. 17 · Core clauseChina GenAI MeasuresGDPR Art. 35, Art. 36 · Core clauseGDPRISO 42001 6.1.4, 8.4, A.5 · Core clauseISO 42001ISO 42005 42005 5.8, 42005 6.8, 42005 5.12 · Core clauseISO 42005+7 more+7 more: Korea AI Act Art. 35, NIST AI RMF MAP 3, MAP 5, TC260 Framework 3.0 TC260 Appendix 1, TC260 2.2, UK ATRS ATRS 2.5.1, CoE Convention CoE Art. 16, EU AI Act Art. 9, GAO AI Accountability 1.5Cases (2)Dutch childcare benefits: nationality as a risk indicator · Cites the articleDutch childcare benefitsSyRI: a fraud risk model no court could verify · Cites the articleSyRI judgmentEU AI Act Art. 27
What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.
Data table: every relation
Relations of AIGE-OBL-EUAIA-ART27
FamilyItemRelation
PatternsFRIA-as-CodeDirect
PatternsVendor / Model Due-Diligence GateDirect
CasesDutch childcare benefits: nationality as a risk indicatorCites the article
CasesSyRI: a fraud risk model no court could verifyCites the article
Same crosswalk topicAI Verify 11.2.1, 4.2.1Core clause
Same crosswalk topicCSA AICM GRC-10, DSP-09Core clause
Same crosswalk topicChina GenAI Measures GenAI Art. 17Core clause
Same crosswalk topicGDPR Art. 35, Art. 36Core clause
Same crosswalk topicISO 42001 6.1.4, 8.4, A.5Core clause
Same crosswalk topicISO 42005 42005 5.8, 42005 6.8, 42005 5.12Core clause
Same crosswalk topicKorea AI Act Art. 35Core clause
Same crosswalk topicNIST AI RMF MAP 3, MAP 5Core clause
Same crosswalk topicTC260 Framework 3.0 TC260 Appendix 1, TC260 2.2Core clause
Same crosswalk topicUK ATRS ATRS 2.5.1Core clause
Same crosswalk topicCoE Convention CoE Art. 16Related clause
Same crosswalk topicEU AI Act Art. 9Related clause
Same crosswalk topicGAO AI Accountability 1.5Related clause

Patterns that build it

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Impact assessment

Cases that cite this article

Source

Chapter 08, section EU AI Act, post-Omnibus, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). EU AI Act Art. 27: Fundamental Rights Impact Assessment (FRIA) (AIGE-OBL-EUAIA-ART27). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-euaia-art27. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{EU AI Act Art. 27: Fundamental Rights Impact Assessment (FRIA) (AIGE-OBL-EUAIA-ART27)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-euaia-art27},
  note         = {Version 0.5.0}
}