⚠ Medium compliance impact for SMEs
WHAT THE ARTICLE IS ABOUT
A pre-deployment rights check for certain high-risk AI deployers
Article 27 requires certain deployers of high-risk AI systems to carry out a fundamental rights impact assessment before first use. It builds directly on Article 26’s deployer obligations and goes further — mandating a structured evaluation of how the AI system could affect the fundamental rights of the people it will impact, with results to be reported to market surveillance authorities.
WHAT IT SAYS
Who must assess, what must be covered, and what must be reported
- The following deployers must carry out a fundamental rights impact assessment before first use: public bodies, entities providing public services on behalf of public bodies, and private entities deploying high-risk AI systems in the areas of biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice
- The assessment must describe: the processes in which the AI system will be used and their purpose; the period and frequency of use; the categories of individuals who will be affected; the specific risks of harm to fundamental rights; the human oversight measures in place; and the measures to be taken if those risks materialise
- Once completed, the deployer must notify the relevant market surveillance authority of the results using a template provided by the AI Office
- Where the assessment overlaps with a GDPR data protection impact assessment, the two must complement each other — the fundamental rights assessment does not replace the GDPR assessment
- The AI Office will develop a standardised questionnaire template to simplify the process for deployers
WHO IS AFFECTED
Public bodies and private entities providing public services
- Public authorities at all levels — national, regional and local — deploying high-risk AI in any of the listed categories
- Private companies contracted to provide public services — healthcare providers, social services contractors, education institutions, utilities
- Financial institutions using high-risk AI for credit scoring or fraud detection in certain contexts
- Private employers using AI for recruitment or workforce management in Annex III categories
- Notably: purely private commercial deployers not providing public services have lighter obligations under this article
WHAT IT MEANS FOR SMES
Check whether you qualify — then use the AI Office template
- Most purely commercial SMEs are not subject to this specific assessment obligation — it is primarily aimed at public bodies and entities providing public services
- However if your SME provides services to public bodies under contract and deploys high-risk AI in doing so, you may be considered a deployer of public services and fall within scope
- If you are in scope: wait for the AI Office questionnaire template before building your own framework — the template is designed to simplify the process and will be the format authorities expect
- Coordinate with your GDPR data protection impact assessment — if you already conduct DPIAs for AI systems, the fundamental rights assessment should be integrated into that process rather than run separately
- The notification obligation to market surveillance authorities means this assessment creates a formal regulatory paper trail — treat it with the same rigour as your GDPR documentation
Related Articles
- Article 26 — Deployer obligations (the broader framework within which Article 27 sits)
- Article 6 — High-risk classification (determines which systems require this assessment)
- Article 43 — Conformity assessment (the provider-side equivalent process)
- Article 74 — Market surveillance (the authorities to whom results must be reported)
