Binds: Deployers that are public bodies, and certain private deployers
All obligations
EU AI Act Art.27: Fundamental rights impact assessment for high-risk AI systems
EU AI Act Article 27 (Fundamental rights impact assessment for high-risk AI systems) binds the deployers that are public bodies, and certain private deployers. This page states what the article requires, who it binds, the evidence to keep and the NIST AI RMF and ISO/IEC 42001 controls behind it, cited to the article. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.27 |
| Binds | Deployers that are public bodies, and certain private deployers |
| Group | High-Risk Operator Obligations |
| Evidence items | 2 |
| Linked NIST AI RMF controls | 3 |
| Linked ISO/IEC 42001 controls | 3 |
| Last updated |
Who does Art.27 bind?
The article binds the deployers that are public bodies, and certain private deployers. The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.27 require?
The fundamental rights impact assessment applies to deployers that are bodies governed by public law or private operators providing public services, and to deployers of the Annex III systems in points 5(b) and 5(c) (creditworthiness and access to essential services), excluding Annex III point 2. It covers the process, the period and frequency of use, the people likely to be affected, the specific risks, the human oversight measures and the internal governance, and it feeds the data protection impact assessment where one is required. Read Article 27 on the Service Desk.
Earlier summary of this article
Before deploying a high-risk AI system referred to in Art.6(2) (Annex III), public-law-governed deployers (and certain private deployers providing public services + financial services) shall perform a fundamental rights impact assessment (FRIA) describing the deployment context, the categories of affected persons, the specific risks of harm to fundamental rights, the human-oversight measures, and the measures to be taken in case of materialisation of those risks; the deployer shall notify the market surveillance authority of the results.
The statement above is the current position; the earlier summary is kept for the change history.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.27 (the consolidated Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.27?
| Category | Evidence to keep |
|---|---|
| FRIA | FRIA per in-scope deployment |
| FRIA | Notification to market surveillance authority |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.27?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-GV-4.2 | Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate and use, and communicate about the impacts more broadly The fundamental rights impact assessment documents risks and impacts and is notified beyond the team. | high |
AIRMF-MP-3.2 | Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness are examined and documented, as connected to organizational risk tolerance The assessment describes specific risks of harm to fundamental rights, which are the non-monetary costs. | high |
AIRMF-MP-5.1 | Likelihood and magnitude of each identified impact are identified and documented, based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team, or other data The assessment describes affected categories of persons and the specific risks of harm to each. | high |
Which ISO/IEC 42001 controls line up with Art.27?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.5.2 | AI system impact assessment process Fundamental rights impact assessment assesses harm to affected categories of persons before deployment. | high |
A.5.3 | Documentation of AI system impact assessments Assessment must be documented and its results notified to the market surveillance authority. | high |
A.5.4 | Assessing AI system impact on individuals or groups of individuals Assessment names affected persons, specific harms and mitigation for the deployment context. | high |
What does the conformance kit add for Art.27?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.