As a private employer, do we have to carry out a fundamental rights impact assessment (FRIA) for our HR AI?

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

• Fundamental-rights impact assessment AI Act 27
• DPIA for high risk

Sources

1. [1] AI Act Art. 27(1), introductory wording (AI Act, Regulation (EU) 2024/1689). A fundamental rights impact assessment (FRIA) is required for deployers that are bodies governed by public law or private entities providing public services, and for deployers of the systems in Annex III, point 5(b) and (c); systems in Annex III, point 2, are excluded.

   Prior to deploying a high-risk AI system referred to in Article 6(2), with the exception of high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall perform an assessment of the impact on fundamental rights that the use of such system may produce.

   Source, retrieved on 2 October 2026.
2. [2] AI Act, Annex III, point 5(b) and (c) (AI Act, Regulation (EU) 2024/1689). Annex III, point 5(b) and (c), concerns creditworthiness and credit scoring and risk assessment and pricing in life and health insurance.

   AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud; (c) AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance;

   Source, retrieved on 2 October 2026.
3. [3] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.

   Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and

   Source, retrieved on 2 October 2026.
4. [4] Regulation (EU) 2026/1744 Art. 1(13)(a) (replaces AI Act Art. 27(4)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). Anyone who has to carry out a FRIA may refer to the relevant parts of the DPIA or include them.

   If any of the obligations laid down in this Article is already met through the data protection impact assessment conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the deployer may, when conducting the fundamental rights impact assessment referred to in paragraph 1 of this Article, include cross-references to the relevant sections of that data protection impact assessment or include relevant parts thereof in the fundamental rights impact assessment.

   Source, retrieved on 2 October 2026.
5. [5] AI Act, recital 96 (AI Act, Regulation (EU) 2024/1689). Private entities providing public services are linked to tasks of general interest, such as education, healthcare, social services, housing and the administration of justice.

   Services important for individuals that are of public nature may also be provided by private entities. Private entities providing such public services are linked to tasks in the public interest such as in the areas of education, healthcare, social services, housing, administration of justice.

   Source, retrieved on 2 October 2026.