AI Act and GDPR: where a FRIA and a DPIA overlap, and where they don't

Article 27 fundamental rights impact assessments and Article 35 data protection impact assessments ask different questions about the same deployment. What you can genuinely reuse, and what you can't.

If you deploy an AI system that processes personal data and falls within Annex III, you may owe two assessments: a data protection impact assessment under GDPR Article 35, and a fundamental rights impact assessment under Article 27 of the AI Act. They are not alternatives, and they are not duplicates. Article 27(4), as amended by the Digital Omnibus, lets a deployer cross-reference the relevant sections of the data protection assessment, or include parts of it, rather than repeat the work. Note the change: the original 2024 wording said the fundamental rights assessment shall complement the DPIA, and summaries written before July 2026 still quote it that way.

Who owes a FRIA

Article 27 applies to deployers that are bodies governed by public law, or private entities providing public services, when they deploy a high-risk system classified under Article 6(2). Systems intended for the area in Annex III point 2, critical infrastructure, are carved out of that limb. It also applies to any deployer of the systems in Annex III points 5(b) and 5(c), which cover creditworthiness assessment and risk assessment and pricing in life and health insurance, whether or not they provide a public service.

That is a narrower population than the DPIA obligation, which reaches any processing likely to result in a high risk to individuals, in any sector. A private employer running an Annex III recruitment system owes a DPIA and, on the face of Article 27, does not owe a FRIA. Check your own position rather than assuming the two obligations move together.

What each one asks

What genuinely carries over

• The description of the deployment: what the system does, in what process, at what frequency.
• The categories of people affected, where the DPIA identified them properly rather than describing them as 'customers'.
• Mitigation measures that address both lenses, such as accuracy thresholds, appeal routes, and limits on automated decision-making.
• The human oversight arrangement, which is an Article 26(2) duty and a standard DPIA mitigation, so it should already be documented.

What doesn't carry over

A DPIA assesses risk through the lens of personal data. A FRIA assesses harm to fundamental rights whether or not personal data is the vector. Non-discrimination, access to services, workers' rights and the right to an effective remedy sit inside FRIA scope even where the data protection analysis came out clean. A system can be lawful under GDPR and still produce exactly the outcome a FRIA exists to surface.

The outputs also route to different places. A DPIA that leaves high residual risk goes to your supervisory authority for prior consultation. A FRIA is notified to the market surveillance authority. Different regulators, different templates, different escalation paths.

How to run them together

1. 1Settle the role and the classification first. Whether you are provider or deployer, and whether the system is Annex III, decides whether Article 27 is in play at all.
2. 2Do the DPIA wherever Article 35 is triggered. It is the older obligation, the guidance is better developed, and it produces most of the shared material.
3. 3Map the DPIA content onto the Article 27 fields and mark the gaps rather than starting a second document from scratch.
4. 4Fill the gaps with a fundamental rights analysis. Group-level effects and access-to-service harms are usually where the gaps sit.
5. 5Record which document answers which requirement, so a reviewer can follow the cross-references without you in the room.
6. 6Set both to be revisited on the same trigger: any change to the system, its purpose, or the population it affects.

The dependency both assessments share

Both ask what personal data reaches the system and where it came from. Article 26(4) makes input data a standing deployer duty wherever the deployer controls it, and Article 26(9) points deployers at their DPIA obligations using the information the provider supplied. Where the data feeding a system comes from spreadsheets, exports and files on endpoints, that question has no answer until the estate has actually been searched. It is the same gap that leaves Article 30 records incomplete.

Both assessments are legal instruments with regulator-facing consequences, and this post is not legal advice. Article 27's scope in particular turns on whether you are providing a public service, which is a question worth answering with counsel rather than by analogy.