Scoping your first FRIA against the 2 December 2027 Annex III date
Annex III high-risk obligations land on 2 December 2027 under the Digital Omnibus. Working backwards from that date, when does a first assessment actually need to be drafted, reviewed, and filed?
The date is not the deadline for the assessment. It is the date the obligations for the systems in scope begin to apply. The assessment has to be performed before the system is put into service or used, at first use — so for anything still in procurement, the real deadline is your go-live date, not the regulatory one.
Working backwards
Three things consume calendar time and are routinely underestimated. The first is vendor evidence: you cannot describe oversight measures over a system until the provider has told you what the system exposes. The second is internal review, which for most organisations means legal plus the business owner plus, where affected persons are identifiable, a consultation route. The third is remediation — the first draft usually surfaces a gap that has to be closed before anyone signs.
An assessment for a system going live in late 2027 therefore cannot start in late 2027. It starts when the vendor evidence does.
What to prepare now
- An inventory of systems that could fall in Annex III, with the intended purpose written in the Annex's vocabulary rather than the vendor's marketing language.
- For each, the identity of the provider and the deployer, because Art. 25 can move an organisation from one to the other.
- The oversight measures that already exist, so the draft records what is real instead of what sounds right.
Confirm the applicable dates against the current consolidated text; the Digital Omnibus timetable has been amended more than once. This is planning input, not legal advice.