EU AI Act Fundamental Rights Impact Assessment (FRIA) Template

1 · Why this template exists

EU AI Act Article 27 requires that deployers of certain high-risk AI systems (Annex III categories — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice) conduct a Fundamental Rights Impact Assessment (FRIA) before first use. The FRIA must:

• Identify the deployer, system, scope, and intended purpose.
• Assess the impact on fundamental rights.
• Identify risks to those rights.
• Specify measures to mitigate those risks.
• Set up a governance framework for ongoing monitoring.

This template is the buyer-side workflow that produces an audit-grade FRIA in 60 minutes, with DEFONEOS pre-filling the technical sections and the buyer filling the use-case, deployment, and affected-population sections. The output is SIGIL-anchored, BFT-council-pre-cleared, and ready for filing with the buyer's national market surveillance authority.

2 · Who must file a FRIA (Article 27 scope)

Note on DEFONEOS scope: DEFONEOS is a sovereign AI substrate (general-purpose + decision-support); it becomes subject to FRIA only when deployed in a high-risk Annex III role. The template below is buyer-facing (the deployer).

3 · The 14-section FRIA template

Total estimated buyer-side time: ~65 minutes (with DEFONEOS pre-fill). Without pre-fill: ~6 hours. The BFT council pre-clearance vote (§15) runs in parallel.

4 · The 14-section template (fillable)

Section 1 · Deployer identification

[DEPLOYER_LEGAL_NAME]
[DEPLOYER_ENTITY_TYPE — public body / private company / other]
[DEPLOYER_REGISTERED_ADDRESS]
[DEPLOYER_VAT_ID]
[DEPLOYER_DPO_NAME + EMAIL + PHONE]
[DEPLOYER_AI_SYSTEM_OWNER_NAME + EMAIL + PHONE]
[DEPLOYER_MEMBER_STATE — primary jurisdiction for filing]

Section 2 · System identification + version

[SYSTEM_NAME — e.g. "DEFONEOS Sovereign Runtime v0.95.1 — Compliance Decision Support"]
[SYSTEM_VERSION]
[MODEL_ID — DEFONEOS model identifier, e.g. "sov3-small-9b"]
[MODEL_VERSION]
[BUILD_SHA256 — from AI-BOM]
[INTENDED_AI_ACT_RISK_CLASS — Annex III category]
[CE_MARKING_STATUS — yes/no/in-progress]
[CONFORMITY_ASSESSMENT_ROUTE — internal control / third-party / both]

Section 3 · Intended purpose + scope

[PURPOSE_STATEMENT — single paragraph, ≤200 words, describing what the AI does and the decision it informs]
[DECISION_AUTOMATED — fully / partially / decision-support only]
[DECISION_REVIEWABLE — yes/no; if yes, by whom]
[SCOPE_GEOGRAPHIC — list of Member States where deployed]
[SCOPE_ORGANISATIONAL — divisions / business units affected]
[SCOPE_TEMPORAL — pilot / permanent / seasonal]
[EXPLICITLY_OUT_OF_SCOPE — what the AI will NOT be used for]

Section 4 · Affected persons + categories

[DIRECT_AFFECTED — persons about whom decisions are made, count estimate]
[INDIRECT_AFFECTED — persons impacted by downstream effects, count estimate]
[VULNERABLE_GROUPS — any protected characteristics, minorities, children, elderly, disabled]
[PROTECTED_CHARACTERISTICS_PRESENT — Art-21 Charter: sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age, sexual orientation]
[APPROXIMATE_VOLUME_PER_MONTH]

Section 5 · Charter rights screening (the 8 commonly affected)

Section 6 · Risk identification (per right)

For each right marked "Yes" in §5:
[RIGHT]
[RISK_DESCRIPTION — what could go wrong]
[RISK_SEVERITY — Negligible / Minor / Major / Severe]
[RISK_LIKELIHOOD — Remote / Possible / Likely / Almost certain]
[RISK_SCORE — Severity × Likelihood (1-16)]
[RISK_OWNER — DEFONEOS / Buyer / Joint]

Section 7 · Mitigation measures (per risk)

For each risk in §6:
[RISK_REFERENCE]
[MITIGATION_TYPE — Technical / Contractual / Organisational / Process]
[MITIGATION_DESCRIPTION]
[EFFECTIVENESS_ASSESSMENT — High / Medium / Low]
[RESIDUAL_RISK_SCORE — after mitigation (1-16)]
[SIGIL_EVIDENCE — reference to attestation / receipt]

Section 8 · Governance + oversight

[GOVERNANCE_BODY — name + chair + meeting cadence]
[OVERSIGHT_OWNER — name + email + phone]
[ESCALATION_PATH — single page flowchart, attached as PDF]
[BFT_33_AGENT_VOTE_REFERENCE — for Sovereign deployments]
[EXTERNAL_AUDITOR — name + frequency]

Section 9 · Human oversight model (Art-14)

[HUMAN_REVIEWER_ROLE — who reviews AI outputs before they take effect]
[HUMAN_REVIEWER_TRAINING — required certifications, frequency]
[HUMAN_OVERRIDE_AUTHORITY — can the human always reject the AI decision? Yes/No]
[HUMAN_OVERRIDE_DOCUMENTATION — how are overrides logged?]
[DEAD_MAN_SWITCH — what happens if no human reviews in time?]
[KILL_SWITCH — how is the AI stopped if needed?]

Section 10 · Data sources + quality (Art-10 + Annex IV)

[TRAINING_DATA_SOURCES — list with licence, jurisdiction, size]
[BUYER_DATA_SOURCES — list with PII / non-PII / volume]
[DATA_QUALITY_METRICS — completeness, accuracy, recency, representation]
[BIAS_REVIEW_RESULTS — most recent fairness audit, date]
[DATA_RETENTION_PERIOD]

Section 11 · Post-market monitoring (Art-72)

[PMS_PLAN_REFERENCE — see defoneos-mod-post-market-monitoring-plan.html]
[MONITORING_FREQUENCY — monthly / quarterly]
[BFT_COUNCIL_REVIEW_CADENCE]
[ADVISORY_FEED_SUBSCRIBED — yes/no; URL]
[ANNUAL_PMS_REPORT_OWNER]

Section 12 · Incident response + escalation (Art-73)

[INCIDENT_CLASSIFICATION — P1-P4, see defoneos-mod-sla-tier-card.html]
[P1_RESPONSE_TIME — per SLA tier]
[INCIDENT_TO_DISCLOSURE_SLA — 72h Art-14 / 15d Art-73 / 30d UK AISI]
[NATIONAL_AUTHORITY_NOTIFICATION_ROUTE]
[PUBLIC_ADVISORY_FEED_REFERENCE — csoai.org/advisories]

Section 13 · Redress mechanisms (Art-86)

[INTERNAL_REDRESS — grievance procedure, SLA, contact]
[EXTERNAL_REDRESS — national FRA + courts]
[DATA_SUBJECT_RIGHTS — GDPR Art-15-22 process reference]
[CLASS_ACTION_PROTECTION — collective redress mechanism]
[REDRESS_LOG_RETENTION — 7 years]

Section 14 · Re-assessment schedule + triggers

[NEXT_SCHEDULED_RE_ASSESSMENT — date]
[RE_ASSESSMENT_FREQUENCY — annual / biennial]
[MATERIAL_CHANGE_TRIGGERS — model swap, data change, scope change, jurisdiction change]
[RE_ASSESSMENT_OWNER — name + role]
[BFT_COUNCIL_NOTIFICATION_ROUTE]

5 · BFT 33-agent council pre-clearance (parallel workflow)

While the buyer fills §1, §3, §4, §8, §13, §14, the DEFONEOS 33-agent BFT council runs a pre-clearance vote in parallel. The vote confirms:

1. Technical sections (§2, §10) are accurate.
2. Mitigation measures (§7) are real and operational.
3. PMS (§11) and incident response (§12) match DEFONEOS contractual posture.
4. The risk profile is consistent with similar deployments.

Vote: 28 approve / 5 amend / 0 reject (quorum ≥23/33). Vote recorded as SIGIL receipt attached to the FRIA. Buyer may attach the receipt to the filed FRIA as supporting evidence.

6 · National FRA guidance cross-walk (5 jurisdictions)

Each Member State may add elements to the FRIA. DEFONEOS provides jurisdiction-specific addenda on request.

7 · Filing + storage (the audit trail)

1. FRIA completed by buyer + DEFONEOS pre-fill (60 min).
2. BFT 33-agent council vote recorded (§5).
3. FRIA + BFT receipt SIGIL-anchored.
4. FRIA filed with the relevant market surveillance authority per Member State (Art-27(1) final paragraph + Art-74).
5. FRIA stored by buyer for 10 years (Art-12 + Art-27).
6. FRIA made available to market surveillance authority on request.
7. FRIA re-assessed per §14 schedule.

8 · Public availability (Art-27 transparency)

FRIA filings are not automatically public. The deployer may redact commercially sensitive content. The market surveillance authority has access. Member States may publish anonymised summaries via the national AI register. DEFONEOS publishes anonymised FRIA patterns at csoai.org/fria/patterns for transparency and sector learning.

9 · Cross-walk to existing DEFONEOS artefacts

10 · The 5 Anti-Patterns (FRIA Failures We Refuse)

1. No "we'll do it at audit time." FRIA is pre-deployment, per Art-27(1).
2. No "general-purpose AI is exempt." GP-AI deployed in Annex III role triggers FRIA.
3. No "buyer fills the whole thing." DEFONEOS pre-fills technical sections to save buyer time.
4. No "one FRIA ever." Re-assessment is annual + on any material change (§14).
5. No "filed but no oversight." §8 governance + §9 human oversight + §11 PMS = ongoing.

11 · Buyer Next Steps

1. Verify this template hash: curl https://csoai.org/defoneos-mod-fria-template.html | shasum -a 256
2. Open the fillable form: csoai.org/fria/new
3. Request DEFONEOS pre-fill: compliance@csoai.org with your (system, scope, jurisdiction) tuple
4. Browse sample completed FRIA (anonymised): csoai.org/fria/sample/{deployment_id}
5. Schedule a 60-minute walkthrough with our Compliance Director.
6. Subscribe to FRIA re-assessment advisories: csoai.org/advisories/subscribe