Article 27: Fundamental Rights Impact Assessment for High-Risk AI Systems
1.
Prior to deploying a high-risk AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) referred to in Article 6(2), with the exception of high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall perform an assessment of the impact on fundamental rightsfundamental rightsIncludes human dignity, right to life, prohibition of torture, protection of personal datapersonal dataAny information relating to an identified or identifiable natural person ('data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)An identified or identifiable natural person to whom personal data relateGDPR Art. 4(1)'). Includes name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identityGDPR Art. 4(1), freedom of expression, non-discrimination, equality between women and men, rights of the child, right to an effective remedy and fair trialCharter of Fundamental Rights Art. 1–54 that the use of such system may produce. For that purpose, deployers shall perform an assessment consisting of:
(a)
a description of the deployerdeployermeans a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activityArticle 3(4)’s processes in which the high-risk AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) will be used in line with its intended purposeintended purposemeans the use for which an AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) is intended by the providerprovidermeans a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of chargeArticle 3(3), including the specific context and conditions of use, as specified in the information supplied by the providerprovidermeans a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of chargeArticle 3(3) in the instructions for use, promotional or sales materials and statements, as well as in the technical documentationArticle 3(12);
(b)
a description of the period of time within which, and the frequency with which, each high-risk AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) is intended to be used;
(c)
the categories of natural persons and groups likely to be affected by its use in the specific context;
(d)
the specific risks of harm likely to have an impact on the categories of natural persons or groups of persons identified pursuant to point (c) of this paragraph, taking into account the information given by the providerprovidermeans a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of chargeArticle 3(3) pursuant to Article 13;
(e)
a description of the implementation of human oversight measures, according to the instructions for useinstructions for usemeans the information provided by the providerprovidermeans a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of chargeArticle 3(3) to inform the deployerdeployermeans a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activityArticle 3(4) of, in particular, an AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1)’s intended purposeintended purposemeans the use for which an AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1) is intended by the providerprovidermeans a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of chargeArticle 3(3), including the specific context and conditions of use, as specified in the information supplied by the providerprovidermeans a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of chargeArticle 3(3) in the instructions for use, promotional or sales materials and statements, as well as in the technical documentationArticle 3(12) and proper useArticle 3(15);
(f)
the measures to be taken in the case of the materialisation of those risks, including the arrangements for internal governance and complaint mechanisms.
2.
The obligation laid down in paragraph 1 applies to the first use of the high-risk AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1). The deployerdeployermeans a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activityArticle 3(4) may, in similar cases, rely on previously conducted fundamental rightsfundamental rightsIncludes human dignity, right to life, prohibition of torture, protection of personal datapersonal dataAny information relating to an identified or identifiable natural person ('data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)An identified or identifiable natural person to whom personal data relateGDPR Art. 4(1)'). Includes name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identityGDPR Art. 4(1), freedom of expression, non-discrimination, equality between women and men, rights of the child, right to an effective remedy and fair trialCharter of Fundamental Rights Art. 1–54 impact assessments or existing impact assessments carried out by providerprovidermeans a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of chargeArticle 3(3). If, during the use of the high-risk AI systemAI systemmeans a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environmentsArticle 3(1), the deployerdeployermeans a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activityArticle 3(4) considers that any of the elements listed in paragraph 1 has changed or is no longer up to date, the deployerdeployermeans a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activityArticle 3(4) shall take the necessary steps to update the information.
3.
Once the assessment referred to in paragraph 1 of this Article has been performed, the deployerdeployermeans a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activityArticle 3(4) shall notify the market surveillance authoritymarket surveillance authorityAny national authority responsible for carrying out market surveillance on the territory of the Member State concernedRegulation (EU) 2019/1020 Art. 3(4) of its results, submitting the filled-out template referred to in paragraph 5 of this Article as part of the notification. In the case referred to in Article 46(1), deployers may be exempt from that obligation to notify.
4.
If any of the obligations laid down in this Article is already met through the data protection impact assessment conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the deployerdeployermeans a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activityArticle 3(4) may, when conducting the fundamental rightsfundamental rightsIncludes human dignity, right to life, prohibition of torture, protection of personal datapersonal dataAny information relating to an identified or identifiable natural person ('data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)An identified or identifiable natural person to whom personal data relateGDPR Art. 4(1)'). Includes name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identityGDPR Art. 4(1), freedom of expression, non-discrimination, equality between women and men, rights of the child, right to an effective remedy and fair trialCharter of Fundamental Rights Art. 1–54 impact assessment referred to in paragraph 1 of this Article, include cross-references to the relevant sections of that data protection impact assessment or include relevant parts thereof in the fundamental rightsfundamental rightsIncludes human dignity, right to life, prohibition of torture, protection of personal datapersonal dataAny information relating to an identified or identifiable natural person ('data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)An identified or identifiable natural person to whom personal data relateGDPR Art. 4(1)'). Includes name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identityGDPR Art. 4(1), freedom of expression, non-discrimination, equality between women and men, rights of the child, right to an effective remedy and fair trialCharter of Fundamental Rights Art. 1–54 impact assessment.If any of the obligations laid down in this Article is already met through the data protection impact assessment conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the fundamental rightsfundamental rightsIncludes human dignity, right to life, prohibition of torture, protection of personal datapersonal dataAny information relating to an identified or identifiable natural person ('data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)An identified or identifiable natural person to whom personal data relateGDPR Art. 4(1)'). Includes name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identityGDPR Art. 4(1), freedom of expression, non-discrimination, equality between women and men, rights of the child, right to an effective remedy and fair trialCharter of Fundamental Rights Art. 1–54 impact assessment referred to in paragraph 1 of this Article shall complement that data protection impact assessment.
5.
The AI OfficeAI Officemeans the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the CommissionArticle 3(47) shall develop a template for a questionnaire, including through an automated tool, to facilitate deployers in complying with their obligations under this Article in a simplified manner. This template shall, where relevant, give deployers the possibility to include cross-references to the relevant sections of the data protection impact assessment or include relevant parts thereof in the fundamental rightsfundamental rightsIncludes human dignity, right to life, prohibition of torture, protection of personal datapersonal dataAny information relating to an identified or identifiable natural person ('data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)data subjectsubjectfor the purpose of real-world testing, means a natural person who participates in testing in real-world conditionsArticle 3(58)An identified or identifiable natural person to whom personal data relateGDPR Art. 4(1)'). Includes name, ID number, location data, online identifiers, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identityGDPR Art. 4(1), freedom of expression, non-discrimination, equality between women and men, rights of the child, right to an effective remedy and fair trialCharter of Fundamental Rights Art. 1–54 impact assessment pursuant to paragraph 4.The AI OfficeAI Officemeans the Commission’s function of contributing to the implementation, monitoring and supervision of AI systems and general-purpose AI models, and AI governance, provided for in Commission Decision of 24 January 2024; references in this Regulation to the AI Office shall be construed as references to the CommissionArticle 3(47) shall develop a template for a questionnaire, including through an automated tool, to facilitate deployers in complying with their obligations under this Article in a simplified manner.