FRIA Readiness Checker — TOOLKIT-AIMS-FRIA-001-CL

Part A — Trigger Assessment Readiness

Part A: Do You Know Whether Article 27 Applies?

These six questions assess whether your organisation has the foundational information needed to complete Part A of the FRIA Workbook — the trigger assessment that determines whether a full FRIA is required.

Question A1 · 2 points

Has your organisation completed an Annex III AI system classification exercise using a structured register (e.g. REG-AIMS-CLASS-001)?

Article 27 is only triggered by High-Risk AI systems classified under Annex III. Without a classification register, you cannot determine whether Article 27 applies — and you cannot complete Part A.

Points: —

Question A2 · 2 points

Do you know the classification outcome for every AI system currently in use by your organisation?

Part A requires you to list all AI systems and their Annex III classification. If any system's classification is unknown or provisional, Part A cannot be signed off with confidence.

Points: —

Question A3 · 2 points

Has your organisation assessed whether the Article 27(2) extended scope applies — specifically, AI use in creditworthiness assessments, insurance risk scoring, or employment decisions?

Article 27(2) extends the FRIA obligation to private-sector deployers beyond public bodies in specific use cases. Organisations relying solely on the private-entity carve-out without assessing Article 27(2) may be in scope without knowing it.

Points: —

Question A4 · 2 points

Is the individual who will lead the FRIA process identified — specifically, the COLP, DPO, or designated AI Governance Lead?

The FRIA requires a named responsible person to sign off. Starting the workbook without a confirmed lead creates a bottleneck at sign-off and risks producing an unsigned compliance document.

Points: —

Question A5 · 2 points

Does your organisation have a documented process for monitoring AI system classification status — so that a reclassification triggers a review of this FRIA assessment?

Part A is not a one-time exercise. The non-trigger confirmation expires when conditions change. Without a monitoring process, a new High-Risk AI deployment may go undetected and unassessed.

Points: —

Question A6 · 2 points

Does your organisation understand the regulatory deadline — that High-Risk AI obligations under the EU AI Act apply from 2 August 2026 for most Annex III systems?

Deployers of High-Risk AI systems became subject to Article 27 obligations from 2 August 2026. If your organisation has not yet completed a FRIA for a High-Risk system already in use, it is currently non-compliant.

Points: —

Part B — Full FRIA Readiness

Part B: Are You Ready to Complete the Eight FRIA Dimensions?

These six questions assess whether your organisation has the information and governance infrastructure needed to complete Part B of the FRIA Workbook — the full eight-dimension assessment required before deploying a High-Risk AI system.

Question B1 · 2 points

Do you have detailed operational documentation of the specific AI system to be assessed — including the use case, input/output description, volume of decisions, and the team using it?

Dimension A (Processes) and Dimension B (Time & Frequency) require specific operational detail. Generic vendor product descriptions are insufficient. You need to know what your organisation actually does with the system.

Points: —

Question B2 · 2 points

Can you identify every category of natural person affected by the AI system's outputs — including third parties and vulnerable groups — with estimated numbers?

Dimension C requires a complete picture of affected persons. This is not just direct users — it includes clients, third parties named in documents, and anyone whose life circumstances the AI output might affect. Vulnerability factors must be considered.

Points: —

Question B3 · 2 points

Does your organisation have access to qualified legal input for the fundamental rights risk assessment — specifically, a solicitor or legal adviser who can assess Charter rights implications?

Dimension D (Rights Risks) is the most technically complex section. The EU Charter of Fundamental Rights assessment should involve qualified legal input. An internally completed Dimension D without legal review may not withstand supervisory scrutiny.

Points: —

Question B4 · 2 points

Do you have documented human oversight procedures for the AI system — specifically, who reviews AI outputs, their qualifications, and what happens when they disagree with the AI?

Dimension E (Human Oversight) requires specific procedural documentation, not general statements. The HITL procedure (PROC-AIMS-HITL-001) or equivalent must exist before this dimension can be completed substantively.

Points: —

Question B5 · 2 points

Has a Data Protection Impact Assessment (DPIA) been conducted for this AI system, or has a formal determination been made that one is not required?

Dimension H requires you to document the relationship between the FRIA and any DPIA. If a DPIA has neither been completed nor formally determined unnecessary, Dimension H cannot be completed — and this is one of the most commonly audited gaps.

Points: —

Question B6 · 2 points

Do you have both a COLP (or equivalent senior sign-off authority) and an AI Risk Owner who are available and briefed to sign off the FRIA before the AI system goes live?

Part B requires dual sign-off: the COLP and the AI Risk Owner. Both must be identified, briefed on the FRIA, and available to sign before the AI system enters service. A FRIA with only one signature, or with an uninformed signatory, is a compliance failure.

Points: —

Your FRIA Readiness Verdict

—

Score Breakdown

Part A — Trigger Assessment Readiness (Q1–Q6)— / 12

Part B — Full FRIA Readiness (Q7–Q12)— / 12

Total Score— / 24

Your Priority Actions — What to Do First

Next Step

Ready? Open the FRIA Workbook

Once your readiness score confirms you have the prerequisites in place, open WKBK-AIMS-FRIA-001 and complete the full Article 27 assessment.

Get the Full Pack — £97 Academy Member? Access on Skool