Fundamental Rights Impact Assessment (FRIA) vs DPIA: The Two Assessments Your AI Project May Need

A DPIA asks whether your use of personal data puts people's rights and freedoms at high risk. A FRIA asks whether your use of a high-risk AI system could harm people's fundamental rights, from non-discrimination to access to public services. Many AI projects need a DPIA. Far fewer need a FRIA, because the AI Act limits it to specific deployers. Where both apply, the law expects them to work together: Article 27(4) of the AI Act says the FRIA complements the DPIA, not replaces it.

This guide explains who must do each assessment, what each must contain, when both are needed, and how to run them as one integrated process.

DPIA: Data protection impact assessment, GDPR Article 35. Required since 25 May 2018.
FRIA: Fundamental rights impact assessment, EU AI Act Article 27
DPIA trigger: Processing likely to result in a high risk to individuals' rights and freedoms
FRIA trigger: Certain deployers using high-risk AI systems listed in Annex III
FRIA applies from: 2 December 2027 for new Annex III systems, after the Digital Omnibus delay
Who receives it: DPIA: kept internally, prior consultation with the DPA if high risk remains. FRIA: results notified to the market surveillance authority.
Official FRIA template: Being developed by the EU AI Office; not published as of October 2026

The core difference in one table

Dimension	DPIA (GDPR Art. 35)	FRIA (AI Act Art. 27)
What triggers it	High-risk processing of personal data, with or without AI	Deploying a high-risk AI system in Annex III, by certain deployers
Who must do it	The controller	The deployer (not the provider)
What is protected	Rights and freedoms affected by personal data processing	All fundamental rights in the EU Charter that the AI system could affect
Needs personal data?	Yes	No. Applies even without personal data.
Key questions	Necessity, proportionality, risks to data subjects, safeguards	Processes, duration, affected groups, risks of harm, human oversight, remedies
Regulator involvement	Prior consultation with the DPA if high residual risk remains (Art. 36)	Results notified to the market surveillance authority, using the AI Office template
When	Before processing begins	Before first use of the high-risk system
Updates	When the risk changes	When any required element changes or is no longer current
Official template	National DPA lists and guidance	AI Office questionnaire, still in development

When you need a DPIA

Article 35 of the GDPR requires a DPIA before any processing likely to result in a high risk to individuals' rights and freedoms, especially when using new technologies. AI almost always counts as a new technology. A DPIA is expressly mandatory for three kinds of processing:

Systematic and extensive evaluation of people, including profiling, that leads to decisions with legal or similarly significant effects
Large-scale processing of special category data or criminal-offence data
Systematic monitoring of a publicly accessible area on a large scale

Beyond those, the European Data Protection Board's guidelines (WP248) list nine criteria, including evaluation or scoring, automated decisions with significant effect, sensitive data, vulnerable data subjects and innovative technology. As a rule of thumb, processing that meets two or more criteria usually needs a DPIA. Many AI uses meet at least two.

The minimum content is set by Article 35(7): a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of risks to individuals, and the measures to address them.

When you need a FRIA

The FRIA is much narrower. Under Article 27(1), it applies only when a high-risk AI system listed in Annex III is used by one of three kinds of deployer:

Public bodies

Bodies governed by public law, such as ministries, municipalities, agencies and public universities.

Public-service providers

Private entities providing public services, such as some healthcare, education or utility providers.

Credit and insurance deployers

Anyone using AI for creditworthiness or credit scoring (except fraud detection), or for life and health insurance risk assessment and pricing.

Systems used as safety components in critical infrastructure (Annex III, point 2) are excluded. And the FRIA applies to the deployer, not the provider who built the system.

A private employer usually doesn't need a FRIA

AI used for recruitment is high-risk under Annex III. But a private company screening CVs with it is not a public body or public-service provider, so Article 27 doesn't apply. It will still very likely need a DPIA. The same tool used by a government agency needs both.

The six things a FRIA must contain

The deployer's processes
How the high-risk AI system will be used, in line with its intended purpose.
Period and frequency of use
How long and how often the system will be used.
Affected people and groups
The categories of people and groups likely to be affected in this specific context.
Specific risks of harm
The risks to those people and groups, taking into account the provider's information under Article 13.
Human oversight
How human oversight measures will be implemented, following the provider's instructions for use.
What happens if risks materialise
Measures to take, including internal governance and complaint mechanisms.

Which assessment does your AI project need?

Scenario	DPIA	FRIA
Public agency uses AI to screen job applicants	Very likely	Yes
Private company uses AI to screen job applicants	Very likely	No
Bank uses AI for credit scoring	Very likely	Yes
Insurer uses AI to price life or health insurance	Very likely	Yes
Municipality uses AI to assess eligibility for benefits	Very likely	Yes
Utility uses AI as a safety component in its grid	Depends on personal data	No (critical infrastructure excluded)
Company deploys a customer-service chatbot	Depends on data and risk	No (not high-risk)
Bank uses AI only for fraud detection	Likely	No (fraud detection excluded)

"Very likely" reflects the common case where AI evaluates people using personal data with significant effects. Confirm against your DPA's published list of processing that requires a DPIA.

Not sure which applies to your project?

I share practical breakdowns of AI Act and GDPR assessments most weeks. Connect with me on LinkedIn and tell me which scenario you're working through.

Where they overlap, and where they don't

The two assessments share a lot of ground: a description of the system, the people affected, the risks and the safeguards. But the FRIA's lens is much wider. A system can comply fully with data protection law and still harm people's fundamental rights.

What a DPIA covers well

Lawful basis, purpose limitation and minimisation
Retention and deletion
Data subject rights
Data security
Necessity and proportionality of the processing

What only the FRIA adds

Non-discrimination and equality
Human dignity and access to public services
Rights of children, people with disabilities and other vulnerable groups
Human oversight in the deployer's real process
Complaint and redress mechanisms
Impacts with no personal data involved

Article 27(4) builds the bridge

If you've already met any FRIA obligation through a DPIA, the FRIA complements that DPIA. The AI Office template must also allow cross-references to a DPIA. In practice, that means one integrated assessment with a fundamental-rights section on top.

6elements every FRIA must cover (Article 27(1)(a)–(f))

9EDPB criteria for spotting high-risk processing that needs a DPIA

€1.2bnin GDPR fines imposed during 2025 (DLA Piper)

Enforcement: very different exposure

Failing to carry out a required DPIA, or doing an inadequate one, can draw GDPR fines of up to €10 million or 2% of global annual turnover. DPAs are active. DLA Piper's January 2026 survey reported about €1.2 billion in GDPR fines in 2025 and €7.1 billion since 2018.

FRIA enforcement is still ahead. Obligations for Annex III systems apply from 2 December 2027, and national market surveillance authorities will receive FRIA notifications. Unlike the core deployer duties in Article 26, Article 27 is not named in the AI Act's fixed fine tiers, so penalties will depend on national rules made under Article 99. Expect the FRIA notification itself to become the first thing regulators ask for.

Timing: when each applies

25 May 2018
GDPR applies; DPIAs mandatory for high-risk processing.
1 Aug 2024
AI Act enters into force, including Article 27.
Jun 2026
Digital Omnibus on AI adopted, moving Annex III high-risk obligations to December 2027.
Oct 2026
AI Office FRIA template still unpublished.
End 2026
Joint EDPB–Commission guidelines on GDPR and AI Act interplay expected.
2 Dec 2027
FRIA required before first use of new Annex III high-risk systems.
2 Aug 2030
Latest date for high-risk systems already used by public authorities to comply.

Don't wait for the FRIA template to start

The template will tell you how to report, not how to think. The six elements are already set out in Article 27. Public bodies building systems now will need FRIAs before go-live from December 2027, and design decisions made today shape what the FRIA finds.

How to run both as one integrated assessment

Screen early
At project start, check three questions: does it process personal data at high risk (DPIA)? Is the AI high-risk under Annex III? Are we a public body, public-service provider, or credit or insurance deployer (FRIA)?
Write one system description
Cover purpose, process, data, model, provider and deployment context once, with enough detail for both assessments.
Get the provider's documentation
Ask for the instructions for use. Article 26(9) tells deployers to use it for their DPIA, and the FRIA must account for the provider's Article 13 information.
Map affected people widely
Go beyond data subjects to every group whose rights could be affected, including people who are scored or excluded without their data ever being processed.
Assess risks through two lenses
One risk register, with privacy risks (unlawful processing, over-retention, breaches) alongside fundamental-rights risks (discrimination, loss of access, lack of redress).
Design oversight and remedies
Define who reviews AI outputs, with what authority, and how affected people can complain. This serves the FRIA, GDPR Article 22 and good practice.
Decide, notify and review
Consult the DPA if high data protection risk remains. Notify the market surveillance authority of FRIA results. Review both when the system, data or context changes.

Common mistakes to avoid

Assuming a DPIA covers fundamental rights beyond data protection
Assuming every AI deployer needs a FRIA, rather than only the categories in Article 27
Expecting the AI provider to do the FRIA, when it's the deployer's duty
Running the two assessments in separate teams with inconsistent findings
Treating either assessment as a one-off document rather than one you keep updated
Waiting for the AI Office template before starting work

A prompt to draft an integrated DPIA and FRIA

Paste in your project details to get a first draft. Your DPO and legal team should review and complete it.

Integrated DPIA + FRIA drafting prompt

You are a privacy and AI governance specialist familiar with GDPR
Article 35 and EU AI Act Article 27.

Our project:
[organisation type (public body, public-service provider, bank,
insurer, private company); AI system and provider; purpose; process
it supports; personal data used; people affected; how long and how
often it will be used; human oversight in place; complaint channels]

Produce:
1. A screening result: is a DPIA required (with the GDPR Art. 35(3)
   case or EDPB criteria met), and is a FRIA required under AI Act
   Art. 27(1)? Give reasons.
2. One shared system description covering both assessments.
3. A DPIA section covering the four Art. 35(7) elements.
4. A FRIA section covering the six Art. 27(1) elements (a) to (f).
5. A single risk table with columns: risk, affected group, right
   affected (privacy or other fundamental right), likelihood,
   severity, mitigation, owner.
6. Whether residual risk suggests prior consultation with the data
   protection authority.
7. A list of missing information, marked UNKNOWN.

Use only what I provide. Flag where legal review is needed.

A DPIA asks whether you may use the data. A FRIA asks whether people will be treated fairly once you do. The first is about information; the second is about lives. — Kumail Mehdi

Frequently asked questions

Is a FRIA the same as a DPIA?

No. A DPIA under GDPR Article 35 assesses high-risk personal data processing. A FRIA under AI Act Article 27 assesses risks to all fundamental rights from using a high-risk AI system, whether or not personal data is involved. The FRIA complements an existing DPIA rather than replacing it.

Who has to carry out a FRIA?

Deployers of high-risk AI systems listed in Annex III that are bodies governed by public law, private entities providing public services, or deployers using AI for creditworthiness or for life and health insurance pricing. Critical infrastructure systems are excluded.

Does the AI provider do the FRIA?

No. It is the deployer's obligation. The provider supplies the information the deployer needs, especially the instructions for use, but the assessment depends on how and where the deployer uses the system.

When does the FRIA obligation start?

For new Annex III high-risk systems, from 2 December 2027, after the Digital Omnibus on AI moved the high-risk deadlines. The FRIA must be done before the system is first used.

Is there an official FRIA template?

The AI Office must publish a questionnaire template, possibly with an automated tool. As of October 2026 it had not been published. Several national and academic templates exist, including the Netherlands' updated IAMA human-rights assessment.

Can I combine the DPIA and FRIA into one document?

Yes, and it's the recommended approach. Article 27(4) explicitly links them, and the AI Office template must allow cross-references to a DPIA. Just make sure every element of both Article 35 GDPR and Article 27 AI Act is covered.

Master AI governance in 6 months — 15 minutes a week

Join AI Governance – Decoded, my weekly newsletter that breaks down AI Act assessments, GDPR, ISO 42001 and the frameworks around them into one short, practical read. And if you want to talk through your own assessment process, connect with me on LinkedIn.

Subscribe to AI Governance – Decoded

Fundamental Rights Impact Assessment (FRIA) vs DPIA: The Two Assessments Your AI Project May Need

The core difference in one table

When you need a DPIA