A high-risk AI system cannot go live without a completed FRIA.
Most organisations have neither.

It depends on two things. First, Article 27(1) applies directly to bodies governed by public law and private operators providing public services — so a firm contracted to provide legal aid (a public service) likely falls within scope. Second, Article 27(2) extends the obligation to certain private-sector deployers where AI systems are used for creditworthiness assessments, insurance risk scoring, or employment-related decisions. If neither applies, Article 27 does not currently require a full FRIA — but you still need a documented non-trigger confirmation (Part A) to evidence that the assessment was made. A private firm that simply has no documentation is not in a defensible position if a deployment decision is later challenged.

Bottom line: If you are unsure, Part A takes 30 minutes and gives you a signed compliance document either way. Part B is only required if the trigger is met.

No. A DPIA and a FRIA are distinct documents with different legal bases, different scopes, and different outputs. The DPIA (required under UK GDPR / EU GDPR Article 35) focuses on risks to data subjects arising from personal data processing. The FRIA (required under EU AI Act Article 27) covers the broader fundamental rights impacts of the AI system — including rights that have nothing to do with data protection: human dignity (Charter Art. 1), non-discrimination (Charter Art. 21), effective remedy (Charter Art. 47), and the rights of the child (Charter Art. 24).

Where both a DPIA and a FRIA are required for the same AI system, they shall be coordinated — Dimension H of the FRIA documents that coordination. But a DPIA does not substitute for a FRIA and cannot be presented as one to a supervisory authority.

If you have a High-Risk AI system already in service — classified under Annex III and in scope for Article 27 — and you have not completed a FRIA, then yes: you are currently non-compliant with the Regulation's pre-deployment requirement. Article 27 requires the FRIA to be completed before deployment, not after.

The practical response to this position is to complete the FRIA immediately and assess, in Dimension G, whether retroactive risk mitigation is required. A completed FRIA filed after deployment, with a documented remediation assessment, is materially stronger than no FRIA at all. Supervisory authorities will consider the remediation effort in any enforcement action — but a blank where the document should be is the worst possible position.

Do not wait. Open the workbook now and complete Part B for any High-Risk system currently in service.

The FRIA Workbook is a compliance tool — a structured template that guides your organisation through the Article 27 assessment process and produces a signed compliance record. It does not constitute legal advice and is not a substitute for qualified legal input on the specific facts of your deployment.

In particular, Dimension D (the EU Charter rights risk assessment) should involve a qualified solicitor or legal adviser with knowledge of fundamental rights law. The workbook structures and guides that assessment, but the legal judgements within it are made by the responsible individuals at your organisation — not by the template.

The workbook is built to the exact Article 27 specification and aligned to ISO/IEC 42001:2023, ITIL 4, and IEC 82079-1:2012. It has been designed to withstand supervisory scrutiny. But it is a tool, not a legal service.

A HIGH residual risk in Dimension D is a blocking condition on Part B deployment approval. The workbook is explicit on this: the AI system shall not enter service in the high-risk use case while a HIGH residual risk remains open with no closed Dimension G mitigation action.

If mitigation is not immediately achievable, you have two options. First, you can select the "Deferred — Not Approved" deployment determination and document the basis — this is a valid, signed compliance document that shows the organisation assessed the risk and made a considered decision not to deploy. Second, you can implement interim controls that reduce the residual risk to MEDIUM, document them in Dimension G with an owner and a completion deadline, and proceed to sign-off with the interim controls in place and the full mitigation action outstanding.

What you cannot do is sign off the "Approved for Deployment" determination while a HIGH residual risk exists with no mitigation. That would be a false compliance record.

The £97 one-time purchase includes both documents in the FRIA Pack: the complete FRIA Workbook (WKBK-AIMS-FRIA-001 v2.0) and the scored Readiness Checker (TOOLKIT-AIMS-FRIA-001-CL). Both are delivered as self-contained HTML files with full print-to-PDF styles — open in any modern browser, complete on screen, and print to A4 for wet signature and filing.

Purchase is processed through ClickBank. You will receive access immediately after purchase — no email gate, no waiting period, no subscription. There are no upsells: the £97 covers both documents in full.

If you are a UNUS London Governance Academy member, both documents are available free inside your Skool membership. Log in, navigate to the EU AI Act Bridge Series, and open the FRIA Workbook module.

This workbook is Gap D of the EU AI Act Bridge Series — the six-module programme covering every statutory obligation the EU AI Act creates for UK organisations deploying AI systems. The FRIA Workbook depends on REG-AIMS-CLASS-001 (the Annex III AI Classification Register, Gap B of the Series) for the classification outcomes that determine whether Article 27 is triggered.

The full Series covers: Gap A (AI Governance Framework), Gap B (Annex III Classification), Gap C (GPAI Model Assessment), Gap D (FRIA — this workbook), Gap E (Human-in-the-Loop Procedures, PROC-AIMS-HITL-001), and Gap F (Ongoing Monitoring and Annual Review). Governance Academy members have access to all six gaps within their membership.