Is a FRIA the same thing as the AI Act conformity assessment?

No. The conformity assessment under the AI Act is a provider obligation focused on demonstrating the system meets technical requirements before CE marking, while the FRIA is a deployer obligation focused on the real-world impact of a specific deployment on affected persons. A device can pass conformity assessment and still require a FRIA at the point of use by a qualifying deployer.

What does a Fundamental Rights Impact Assessment actually need to document?

Article 27 requires the deployer to describe its deployment process and intended use, the categories of natural persons likely to be affected, the specific risks of harm to those persons, the human-oversight measures in place, and the mitigation measures the deployer will take if risks materialise. It is a documented, deployment-specific analysis, not a generic checklist copied from the provider's instructions for use.

What is a common mistake MedTech commercial teams make regarding FRIAs?

A common mistake is assuming the manufacturer's own AI Act conformity work satisfies the customer's FRIA obligation, leaving public hospitals or public-service providers unprepared at go-live. Commercial and clinical-affairs teams should proactively package information on system logic, performance limits, and oversight design so the deploying institution can complete its own Article 27 assessment on schedule.

All terms

RegulatoryRegulated Pathways AI / ML in Devices Quality SystemFRIA

Fundamental Rights Impact Assessment

Assessment deployers of certain high-risk AI systems must complete before first use.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed July 25, 2026

Definition

Article 27 requires deployers that are bodies governed by public law, private operators providing public services, or deployers of certain Annex III systems (creditworthiness, life and health insurance risk assessment) to perform a Fundamental Rights Impact Assessment. It documents the deployment process, categories of persons affected, specific risks of harm, human-oversight measures, and mitigation actions.

What the regulation says

Article 27 of Regulation (EU) 2024/1689, adopted on 13 June 2024 and entering into force on 1 August 2024, requires a Fundamental Rights Impact Assessment before specified high-risk AI systems are first deployed. This obligation applies from 2 August 2026. It covers bodies governed by public law and private entities providing public services that deploy high-risk systems under Article 6(2), excluding Annex III, point 2, critical-infrastructure systems. It also covers deployers of systems listed in Annex III, points 5(b) and 5(c), concerning creditworthiness and credit scoring, and life and health insurance risk assessment and pricing. The assessment must describe deployment processes, intended duration and frequency of use, affected categories of individuals and groups, specific risks of harm, and human-oversight measures. It must also identify responses if risks materialise, including internal governance and complaint mechanisms. Deployers must update the assessment when relevant information changes and notify the market surveillance authority of its results, subject to Article 27(3). Article 27(5) assigns the AI Office responsibility for a questionnaire template. For MedTech, medical-device status alone does not trigger this obligation. A FRIA complements, rather than replaces, an applicable data protection impact assessment.

What this means in practice

Public hospitals and health-service bodies deploying AI-enabled devices may qualify as deployers required to perform a FRIA, even though the manufacturer already performed the AI Act conformity assessment. MedTech commercial teams should be ready to support customers with the information needed for their FRIA.

Examples

A public hospital introducing AI for emergency healthcare patient triage assesses potential harms to different patient groups, documents clinician oversight, and establishes complaint and escalation arrangements before first use.
A health insurer deploying high-risk AI to assess individual insurance risk evaluates potential discriminatory outcomes and documents how staff will review outputs and respond when risks materialize.
A public hospital purchasing an AI imaging device checks whether its intended use falls within the Annex III scope relevant to Article 27 rather than assuming a FRIA is mandatory. The MedTech supplier supports that review with intended-purpose, limitation, and oversight information.

Common pitfalls

•Assuming every AI-enabled medical device used by a public hospital requires a FRIA. Article 27 targets specified Annex III high-risk uses, so public-hospital status alone does not establish the obligation.
•Treating the manufacturer's conformity assessment as a substitute for the deployer's FRIA. Where required, the FRIA addresses the local deployment context and its effects on people.
•Treating a data protection impact assessment as a complete substitute. A FRIA must address the applicable fundamental-rights requirements beyond any overlapping data protection analysis.

Frequently asked questions

Under Article 27 of Regulation (EU) 2024/1689, the FRIA obligation falls on the deployer, not the provider. Deployers that are bodies governed by public law, private operators providing public services, or deployers of certain Annex III high-risk systems such as those used in life or health insurance risk assessment must complete the assessment before first use. Manufacturers of AI-enabled medical devices are not the deployer in most clinical settings, but they typically must supply the technical information the deployer needs to complete it.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Regulatory

High-Risk AI System (EU AI Act)

AI systems captured by Article 6 of the EU AI Act because they are safety components of regulated products or listed in Annex III.

Regulatory

Provider and Deployer (EU AI Act)

The two primary role categories in the AI Act. Providers place systems on the market; deployers put them into use in a professional capacity.

More in Regulatory

· Same category

Regulatory

510(k) Premarket Notification(510(k))

FDA submission demonstrating a device is substantially equivalent to a legally marketed predicate.

Regulatory

510(k) Summary vs 510(k) Statement

Two alternative disclosure mechanisms in a 510(k) submission, a Summary is public on FDA's website; a Statement promises to share Safety & Effectiveness info on request.

Regulatory

513(g) Request for Information(513(g))

Formal mechanism to ask FDA whether a product is a device and, if so, its likely classification.

Regulatory

Abbreviated 510(k)

510(k) variant that relies on FDA guidance, special controls, or recognized consensus standards.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (3)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 2

Link health: 3 verified· last checked 2026-06-20

EUR-Lex·1FDA·1European Commission·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Regulatory0 / 101

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Regulatory
Acronym: FRIA
Sources: 3
Updated: 7/25/2026

Compare with another term

Learn in 60 seconds

Assessment deployers of certain high-risk AI systems must complete before first use.

·MedTech commercial teams should be ready to support customers with the information needed for their FRIA.
·It documents the deployment process, categories of persons affected, specific risks of harm, human-oversight measures, and mitigation actions.

Remember this

Watch out: Assuming every AI-enabled medical device used by a public hospital requires a FRIA. Article 27 targets specified Annex III high-risk uses, so public-hospital status alone does not establish the obligation.

Related terms

You may also need

Auto-suggested from Regulatory and shared keywords.

All Regulatory terms

From the Blue Goat network

Related resources and services on this topic.