FRIA and DPIA explained, with what to include
When you need a fundamental rights impact assessment or a data protection impact assessment, and what goes in each.
Fundamental rights impact assessment (FRIA)
Who needs one: deployers of high-risk AI that are public bodies or private organisations providing public services, and deployers using AI for credit scoring or for life and health insurance pricing (Article 27). Do it before first use.
What to include:
- How and how often the system will be used, and for what.
- The categories of people likely to be affected.
- The specific risks of harm to them.
- The human oversight measures.
- What you'll do if risks materialise, including complaint handling.
You must tell the market surveillance authority the results, using its template.
Data protection impact assessment (DPIA)
Who needs one: any controller whose processing is likely to result in a high risk to people's rights, which includes most AI that profiles people or makes significant automated decisions (GDPR Article 35).
What to include:
- A description of the processing and its purposes.
- Why it's necessary and proportionate.
- The risks to people.
- The measures to address them.
Doing both
The two overlap. Do them together and refer from one to the other. V77 Trust drafts both from the system's purpose, classification and test results; you complete and approve them.