Art. 27 FRIA: who has to file one, and by when

Article 27 is narrower than most summaries suggest. It does not attach to every high-risk deployment. It attaches to deployers that are bodies governed by public law, to private entities providing public services, and to deployers of the Annex III systems in points 5(b) and 5(c) — creditworthiness assessment of natural persons, and risk assessment and pricing for life and health insurance.

If you are outside those categories, Art. 27 does not oblige you to file. You may still carry other deployer duties under Art. 26, and you may still want a written assessment because procurers, insurers, or your own risk function will ask for one. Those are different reasons and it is worth keeping them separate in your records.

What the assessment has to cover

The Regulation asks for a description of the deployment process, the purpose and the period and frequency of use, the categories of persons likely to be affected, the specific risks of harm to those persons, the human oversight measures, and the measures to be taken if a risk materialises — including governance and complaint arrangements.

It is performed before the system is put into service or used, at first use. Where a data protection impact assessment is already required under GDPR Art. 35, the two are meant to be carried out together rather than twice.

Timing

Annex III high-risk obligations apply from 2 December 2027 under the Digital Omnibus timetable. Working backwards: a deployer that waits until the quarter before to write its first assessment will not have time for the review, the sign-off, and the remediation that a first draft usually surfaces.

This is decision-support drafting, not legal advice. Confirm the scope against the current consolidated text of Regulation (EU) 2024/1689 and with qualified counsel before you file.