Builds on AR-000142 (Human Oversight), AR-000210 (High-Risk AI Systems), AR-000230 (Transparency), AR-000240 (Provider Obligations), and AR-000250 (Deployer Obligations). AR-000250 flagged Article 27 as adjacent, out-of-scope territory and recommended it as the next deliverable — this article fulfils that and resolves the open question AR-000250 raised about how Article 26(9) and Article 27 interact.
Executive summary
What this means
Who this applies to
Regulatory context
Requirements
What organizations must do
- Determine whether you fall into one of Article 27(1)'s three deployer categories before assuming a FRIA is required — this test is narrower than general high-risk classification.
- Map any existing GDPR or Law Enforcement Directive DPIA against the six Article 27(1) elements before starting a FRIA from scratch — Article 27(4) allows the FRIA to complement, not duplicate, that work.
- Confirm complete Article 13 documentation has been received from the provider before attempting the FRIA — points (d) and (e) depend directly on it.
- Build a periodic review trigger for the paragraph 2 update obligation rather than treating the FRIA as a one-time, first-use-only exercise.
Common mistakes
Assuming the FRIA applies to every deployer of every high-risk AI system is a common mistake — Article 27(1)'s applicability test is deliberately narrow, with critical infrastructure (Annex III point 2) expressly excluded regardless of deployer type.
Treating the Annex III point 5(c) trigger as covering insurance generally, rather than life and health insurance specifically, is a second mistake — property, casualty, and motor insurance are not named in point 5(c).
Building the FRIA and an existing DPIA as two entirely separate documents, rather than using Article 27(4)'s complementary relationship, risks duplicated effort and inconsistent risk descriptions.
Assuming the Article 27(3) notification exemption is broadly available is a fourth mistake — it applies specifically "in the case referred to in Article 46(1)," not as a general opt-out.
Open questions
- Whether the Digital Omnibus changed which deployer categories or Annex III points trigger the Article 27 obligation. Article 27's page carries the amendment disclaimer; the deployer-category test cited here is pre-Omnibus text.
- Whether the AI Office has published the Article 27(5) questionnaire template and automated tool — not confirmed against a primary source on this pass.
- How a deployer should structure a combined FRIA/DPIA document in practice to satisfy Article 27(4)'s "complement" standard — not addressed by the Regulation's text or any guidance consulted.