EU AI Act
EU AI Act - High-Risk Operator Obligations

EU AI Act EUAI-Art.27: Fundamental rights impact assessment for high-risk AI systems

Before deploying a high-risk AI system referred to in Art.6(2) (Annex III), public-law-governed deployers (and certain private deployers providing public services + financial services) shall perform a fundamental rights impact assessment (FRIA) describing the deployment context, the categories of affected persons, the specific risks of harm to fundamental rights, the human-oversight measures, and the measures to be taken in case of materialisation of those risks; the deployer shall notify the market surveillance authority of the results.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 15 controls across 7 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 42001:2023 · 4 controls

  • A.5.2 AI system impact assessment process
  • A.5.3 Documentation of AI system impact assessments
  • A.5.4 Assessing AI system impact on individuals or groups of individuals
  • A.5.5 Assessing societal impacts of AI systems
  • AIRMF-GV-4.2 Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate and use, and communicate about the impacts more broadly
  • AIRMF-MP-3.2 Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness are examined and documented, as connected to organizational risk tolerance
  • AIRMF-MP-5.1 Likelihood and magnitude of each identified impact are identified and documented, based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team, or other data

NIST SP 800-53 Rev 5 · 3 controls

GDPR · 2 controls

ISO 27001:2022 · 1 control

  • 5.34 Privacy and protection of personal identifiable information (PII)

SOC 2 · 1 control

  • SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in EU AI Act - High-Risk Operator Obligations

You are reading one control. How much of EU AI Act have you already done?

EU AI Act EUAI-Art.27 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of EU AI Act your existing evidence covers. Hold ISO/IEC 42001:2023 and 17 of 43 EU AI Act controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the ISO/IEC 42001:2023 pair alone.

Query this from an agent

The graph holds this control, the 15 it maps to, and the evidence behind each claim, over MCP and REST.