Free browser tool; JavaScript required. Use PALO FRIA to organize evidence about how an AI use case may affect fundamental rights. Record the deployment context, affected people, mitigation and review decisions. See what a useful assessment record contains.

What is FRIA and How to Use This Tool

Click to expand the guide

Collapse

What is FRIA?

A Fundamental Rights Impact Assessment (FRIA) is an Article 27 assessment for certain deployers of high-risk AI systems under Article 6(2). It helps identify how an AI system may affect the fundamental rights protected by the EU Charter in its specific deployment context.

Who must conduct FRIA?
- Public authorities deploying in-scope high-risk AI
- Private entities providing public services
- Deployers of in-scope creditworthiness and life or health insurance risk systems
- Other organizations using this tool voluntarily as a readiness assessment

How to Use This Tool

  1. Step 1 - Context: Enter AI system details and classification
  2. Step 2 - Checklist: Answer governance and compliance questions
  3. Step 3 - Scenarios: Identify potential negative impact scenarios
  4. Step 4 - Assessment: Rate severity and likelihood of each impact
  5. Step 5 - Mitigation: Document risk mitigation measures
  6. Step 6 - Decision: Make deployment decision and generate report
Important: This tool processes all data locally in your browser. No information is sent to any server. Use the Export button to save your progress and Import to resume later.
Regulatory status, reviewed 11 July 2026: The European Commission currently indicates that Annex III high-risk rules apply from 2 December 2027 and product-embedded high-risk rules from 2 August 2028. This tool is a governance-support and pre-screening resource, not legal advice or a compliance certification. Review the current Commission guidance.
1
Context
2
Checklist
3
Scenarios
4
Assessment
5
Mitigation
6
Decision

AI System Context

Provide information about the AI system being assessed.

Tip: Use this assessment to prepare evidence before deployment. Article 27 applies to specific in-scope deployers, including public authorities, public-service providers, and certain creditworthiness and insurance use cases.
FRIA supports Article 27 readiness. A legal obligation applies only to deployers within its scope.

Context Analysis Checklist

Answer these questions about your AI system's governance, data, and oversight.

Impact Scenarios

Identify up to 5 scenarios where the AI system could negatively affect fundamental rights.

Severity & Likelihood Assessment

Assess the severity and likelihood of each identified impact.

Mitigation Measures

Document existing and planned measures to mitigate identified risks.

Deployment Decision

Review your assessment and make a deployment decision.

Step 1 of 6

Build a reviewable fundamental-rights impact record

A useful fundamental-rights impact assessment connects a defined use case to affected people, plausible harms, safeguards and accountable decisions. Completing a checklist alone does not demonstrate that risks are adequately controlled.

What to prepare

  • The intended purpose, deployment setting, responsible organization and people affected.
  • The evidence supporting each impact judgment, including uncertainty and information still missing.
  • Mitigation owners, human oversight, routes for raising concerns and conditions for reassessment.
  • A dated record of decisions and the reasons for accepting, changing or stopping the planned use.

Example: an AI-supported service decision

Map the decision path from data collection to human review and the outcome experienced by the individual. Consider who may be excluded, how errors can be challenged and whether the reviewer can meaningfully change the outcome. Keep the assessment tied to the actual deployment rather than a generic model description.

Does PALO determine whether Article 27 applies?

PALO supports preliminary readiness and voluntary governance work. Determine the applicable duties from the current official sources, actor role and deployment context with the responsible reviewer. The tool is not a legal opinion or certification.

Review official regulatory sourcesStart with risk screeningConnect impacts, controls and evidence

Try a completed fictional FRIA record

A public-service triage example records an affected group, two rights, illustrative impact ratings, missing evidence, mitigation owners and a decision to halt deployment. It uses synthetic information and leaves legal classification unresolved.

Download the worked FRIA JSON. Save your current work first, then use Import to inspect the example across all six steps. Explore governance registers.