From December 2027, public sector organisations, private organisations that provide public services and certain organisations that assess financial risks will be required to carry out a fundamental rights impact assessment in advance when using certain high-risk AI systems. The Dutch Data Protection Authority advises organisations to gain experience with the new obligation now.
With a FRIA, organisations identify in advance the potential impact of a high-risk AI system on fundamental rights, such as the right to equal treatment, human dignity, privacy and access to essential services. They also describe how they mitigate these risks and report on them to the supervisory authority.
The AP is launching a pilot using the European FRIA reporting template. Participants will gain practical experience and receive feedback on their approach. The pilot is not an audit, inspection or enforcement procedure. Applications can be submitted until and including 21 September 2026; the pilot will start at the beginning of October.
A FRIA supplements a DPIA. A DPIA focuses on privacy risks arising from the processing of personal data, whereas a FRIA takes a broader look at the impact of a high-risk AI system on all fundamental rights. The AP is also preparing to supervise compliance with the AI Act. The government intends to designate the AP as the supervisory authority for the majority of high-risk AI systems covered by the regulation.
