Fundamental Rights Impact Assessment (FRIA)

How to use this document

• Use it to document, before starting to use a high-risk AI system, how the system may affect people's rights, which human oversight and response measures are adopted and what the organization decides. Its structure follows the elements of Article 27 of Regulation (EU) 2024/1689 and also works as a format for the prior assessment of public bodies in Peru.
• Give it a clear owner: usually the AI lead or Legal, with the system owner responsible for describing the use and with the data protection officer (or the country's equivalent role) involved when personal data is processed.
• Before adopting it, the organization should decide who approves assessments, which residual risk level it accepts under the "AI Risk Appetite Statement" (the scale is the organization's single scale, section 8) and who handles notification to the authority when applicable.
• Start with the screening in section 2. If it concludes that a FRIA is not required, still file the record of that decision; many organizations complete it voluntarily for systems that affect people.
• Complete one assessment per AI system and per context of use. If the same system is used in different processes (for example, onboarding and renewals), consider whether each process needs its own assessment.
• Reuse what you already have: the data protection impact assessment (DPIA), the internal AI impact assessment and the vendor's instructions for use. Refer to them instead of copying them.
• Keep only the country variant that applies (European Union, Peru or both) and delete the other.
• Fields marked [COMPLETE] include points to confirm with your advisor, especially scope, the competent authority, the notification form and application dates.
• Before approval, have it reviewed by in-house legal or an external advisor. Approve it with the signature of a person with authority over the deployment and store it under version control alongside the AI system inventory.

Fundamental Rights Impact Assessment (FRIA)

Field	Content
Organization deploying the system	[LEGAL ENTITY NAME] ([ORGANIZATION NAME])
AI system assessed	[AI SYSTEM]
System provider and version	[VENDOR] / [COMPLETE]
Identifier in the AI system inventory	[COMPLETE]
High-risk category (for example, Annex III of the AI Act or a high-risk use under the Peruvian regulation)	[COMPLETE]
System owner	[OWNER]
Function coordinating the assessment	[RESPONSIBLE FUNCTION]
Countries of use	[COUNTRY]
Reference of the linked DPIA	[COMPLETE]
Type of assessment	Initial / Update due to change / Periodic review
Version and date	[COMPLETE] / [DATE]
Status	Draft / Under review / Approved / Superseded
AI governance contact	[AI GOVERNANCE EMAIL]

1. Purpose and scope

1.1 This assessment documents the analysis that [ORGANIZATION NAME] carries out before the first use of a high-risk AI system to identify the specific risks to the fundamental rights of affected people and the measures it adopts to prevent, oversee and remedy them.

1.2 It focuses on the actual use of the system in the organization's processes, not on the system in the abstract. For that reason it is completed by whoever deploys and uses the system, with the information supplied by the provider.

1.3 It covers the process in which the system is used, the duration and frequency of use, the affected people and groups, the risks of harm, human oversight and the internal governance and complaint measures.

1.4 This assessment does not replace the data protection impact assessment or the internal AI impact assessment. It complements and refers to them (see section 6).

2. Screening: is a FRIA needed?

2.1 The assessment team answers each question and records the result. The "Consequence" column describes the practice adopted by the organization; legal applicability in each case is confirmed with the advisor.

Part A. European Union (Article 27 of Regulation (EU) 2024/1689)

Question	Yes / No	Consequence
Is the system high-risk under Article 6(2) and listed in Annex III, other than systems in point 2 (critical infrastructure)?		If no, the Article 27 FRIA does not apply; see the final question.
Is the organization a body governed by public law?		If yes and the first answer is yes, the FRIA is carried out.
Is the organization a private entity providing public services (for example, education, healthcare, social services, housing or outsourced administration of justice)?		If yes and the first answer is yes, the FRIA is carried out. [COMPLETE: confirm with your advisor whether the specific activity counts as a public service.]
Is the system used to evaluate the creditworthiness of natural persons or establish their credit score (other than to detect financial fraud)?		The FRIA is carried out, whether the entity is public or private.
Is the system used for risk assessment and pricing of life or health insurance for natural persons?		The FRIA is carried out, whether the entity is public or private.

Part B. Peru (Supreme Decree 115-2025-PCM)

Question	Yes / No	Consequence
Is the organization a public body or state-owned company and is the system high-risk under the regulation?		The prior assessment is carried out in this format (see the Peru variant).
Is the organization a private company using high-risk AI?		The assessment is voluntary; if carried out, it is documented and retained (see the Peru variant).
Does the organization supply AI or AI-enabled services to a Peruvian public body?		Prepare the information the body will need for its assessment (see the Peru variant).

Final question

Question	Yes / No	Consequence
Even if not required, does the system influence decisions with significant effects on people or vulnerable groups?		[AI COMMITTEE] decides whether to carry out the FRIA voluntarily.

2.2 Decision record: conclusion [COMPLETE: carried out / not carried out and reason], decision-maker [OWNER], date [DATE].