Check whether Article 27 applies.
Article 27 covers specified deployers and high-risk uses, including relevant public bodies, public-service providers and certain financial uses. It does not impose the same assessment on every organisation using any AI.
Identify the entity, system and intended use before deciding applicability. Keep the rationale and relevant advice with the system record so later changes can be assessed against the same facts.
Describe the people and the practical consequences.
Map how the system enters the process, the groups affected and the potential consequences of errors or unsuitable use. Consider whether some people face different barriers or have fewer ways to challenge a result. Explain the actual workflow instead of using generic statements about fairness.
Identify information gaps and the people who can resolve them. Supplier evidence may help, but the organisation needs to understand the circumstances of its own service.
Connect concerns to workable safeguards.
For each material concern, identify the proposed mitigation, its owner and how its effectiveness will be reviewed. Include human oversight, escalation and relevant complaint arrangements. Where a measure depends on another team or supplier, make the dependency clear.
- Process and affected-group descriptions.
- Relevant harms, assumptions and evidence.
- Oversight and mitigation responsibilities.
- Review decisions and changes requiring an update.
Coordinate with privacy assessment without conflating it.
A fundamental-rights assessment and a data-protection impact assessment have different legal bases. The current Article 27 permits relevant cross-references where requirements overlap. Check what each assessment must establish rather than assuming one document automatically satisfies both.
EUAIC can help organise the information, actions and approval record. Formal applicability, notifications and adequacy of the assessment require the appropriate accountable reviewers. Keep the official source and the version of the assessment with the deployment decision.