🐉

Fundamental Rights Impact Assessment (FRIA)

EU AI Act Art 27 · Rights-by-Design · 5-Phase Methodology · Impact Scoring · Mitigation Framework · Consultation Protocol · EAT Directive aligned

EU AI ACT ART 27 FRIA ACTIVE

Assessment Phases

Rights Analysed

Risk Levels

90d

Before Deployment

30d

Consultation Period

100%

SIGIL Signed

What is Article 27?

Article 27 of the EU AI Act requires deployers of high-risk AI systems (public bodies and private entities providing services of public interest) to conduct a Fundamental Rights Impact Assessment (FRIA) before putting a high-risk AI system into use. The FRIA must evaluate:

The specific context of use and the persons or groups likely to be affected
The specific risks of harm to fundamental rights that may emerge
The mitigation measures applied — including governance, safeguards, and human oversight
The consultation process with affected groups, where feasible
The reasoning for deploying the system despite identified risks

For DEFONEOS, the FRIA is not just a compliance document — it is the foundation of the entire rights-by-design architecture. Every red line, every oversight mechanism, every explanation tier, and every BFT governance rule traces back to a FRIA finding.

5-Phase FRIA Methodology

Phase 1 — Scope & Context Definition

Define the AI system's intended purpose, deployment context, affected populations, and decision categories. Identify which fundamental rights are engaged. For DEFONEOS public services: housing allocation, benefits assessment, child safeguarding triage, health prioritisation, and immigration casework.

Element	Description
System name & version	DEFONEOS v[version] — [service module]
Intended purpose	Decision support for [public service function]
Deployment context	[Public authority] — [department] — [geography]
Affected populations	Demographic breakdown, vulnerable groups identified
Decision categories	Beneficial / Detrimental / Administrative / Referral
Legal effects	Does the decision produce legal effects? (GDPR Art 22 / Art 86 trigger)

Phase 2 — Rights Mapping & Impact Identification

Systematically evaluate the AI system's impact on each of the 12 fundamental rights domains. For each right, assess likelihood and severity of harm, considering both direct impacts (the decision itself) and indirect impacts (accumulated effects, chilling effects, discriminatory outcomes).

The 12 Fundamental Rights Analysed

#	Right	Legal Source	Risk Vector in DEFONEOS Context
1	Right to life	ECHR Art 2	Medical triage, emergency response prioritisation
2	Right to non-discrimination	ECHR Art 14, EU Charter Art 21	Bias in housing/benefits/child welfare decisions
3	Right to private & family life	ECHR Art 8, EU Charter Art 7	Data collection scope, family profiling
4	Right to data protection	GDPR, EU Charter Art 8	Sovereign storage mitigates; data minimisation required
5	Right to dignity	EU Charter Art 1	Automated decisions affecting human dignity (welfare sanctions)
6	Right to good administration	EU Charter Art 41	Transparency, timeliness, right to be heard
7	Freedom of movement	ECHR Protocol 4	Immigration casework, border decisions
8	Rights of the child	UNCRC, EU Charter Art 24	Child safeguarding triage — heightened protection required
9	Right to an effective remedy	ECHR Art 13, EU Charter Art 47	Right to explanation (Art 86), appeal mechanism
10	Right to fair trial	ECHR Art 6	Automated sanctions with legal effects
11	Freedom of expression & information	ECHR Art 10	Content moderation in public sector communications
12	Social rights	EU Charter Solidarity Ch.	Access to healthcare, housing, social security

Phase 3 — Risk Scoring & Severity Assessment

Each identified impact is scored using a Likelihood × Severity matrix. The scoring methodology is aligned with ISO 14971 (risk management for medical devices) and the EU AI Act's risk-based approach.

Risk Level	Severity	Likelihood	Action Required
CATASTROPHIC	Death, irreversible harm, fundamental rights violation	Any probability	RED LINE — system cannot deploy until mitigated to SERIOUS or below
SERIOUS	Significant legal effects, discrimination, dignity violation	Medium-High	Mandatory mitigation + BFT council approval + ongoing monitoring
MODERATE	Detrimental decision with recourse available	Medium	Mitigation recommended + human oversight mandatory
LOW	Administrative impact, no legal effects	Low	Monitor + document. No special action required.

Phase 4 — Mitigation & Safeguard Design

For each identified risk above LOW, design specific mitigation measures. Mitigations are mapped to DEFONEOS architectural components:

Mitigation Category	DEFONEOS Component	Rights Protected
Red line enforcement	7 immutable red lines at protocol level	Life, dignity, non-discrimination
Human oversight	5-level oversight framework (Art 14)	Effective remedy, fair trial
Right to explanation	5-tier explanation framework (Art 86)	Good administration, effective remedy
Stop button	<2s kill switch, all components	Life, dignity
BFT governance	33-agent council, quorum 23/33	All rights — distributed oversight
Bias monitoring	Continuous fairness metrics, 8 protected characteristics	Non-discrimination
Data minimisation	Sovereign storage, purpose limitation enforced	Privacy, data protection
Record keeping	SIGIL chain, 8 log categories (Art 12)	Good administration, transparency
Automated decision safeguards	7 safeguard layers (Art 22)	Dignity, fair trial
Incident response	7-phase pipeline, Art 73 reporting	All rights — harm prevention

Phase 5 — Consultation, Publication & Review

The FRIA must be informed by consultation with affected groups and relevant authorities. DEFONEOS requires:

30-day public consultation — Draft FRIA published, feedback collected from civil society, affected communities, and equality bodies
Regulator pre-notification — FRIA submitted to relevant MSA / DPA 90 days before deployment
Equality Impact Assessment — Public Sector Equality Duty (s.149 Equality Act 2010) integrated into FRIA
Children's Rights Impact Assessment — UNCRC-aligned assessment when children are affected
Data Protection Impact Assessment — GDPR Art 35 DPIA conducted in parallel
Publication — Final FRIA published in plain language summary + full technical version
Periodic review — FRIA refreshed every 12 months or upon material system change

FRIA Template Structure (Annex VI Aligned)

FUNDAMENTAL RIGHTS IMPACT ASSESSMENT
Article 27, EU AI Act | DEFONEOS v[VERSION]

EXECUTIVE SUMMARY
1 System overview
2 Deployment context
3 Key findings
4 Risk acceptance decision

SYSTEM DESCRIPTION
1 Intended purpose
2 Technical architecture
3 Decision categories
4 Human oversight mechanisms
5 Autonomy level

AFFECTED POPULATIONS
1 Demographic analysis
2 Vulnerable groups identified
3 Consultation summary

RIGHTS IMPACT ANALYSIS
1-4.12 Individual rights assessments (12 rights)
       For each: Impact identified → Likelihood → Severity → Risk score
       → Existing mitigations → Residual risk → Acceptance rationale

MITIGATION FRAMEWORK
1 Technical safeguards (red lines, stop button, BFT)
2 Procedural safeguards (oversight, explanation, redress)
3 Organisational safeguards (DPO, training, audit)

CONSULTATION RECORD
1 Civil society feedback
2 Regulator pre-notification
3 Community engagement

RESIDUAL RISK ACCEPTANCE
1 Decision rationale
2 Conditions for deployment
3 Monitoring requirements
4 Review trigger criteria

SIGNATURES
1 DPO
2 BFT Council quorum confirmation
3 Deployer authority

SIGIL: [Ed25519 signature of full document hash]

Article 27 Compliance Matrix

Requirement	Status	DEFONEOS Implementation
Conduct FRIA before first use	✅ MET	5-phase methodology, 90 days before deployment
Identify specific risks to fundamental rights	✅ MET	12 rights × deployment context = granular risk register
Include measures to be applied	✅ MET	Phase 4: 10 mitigation categories mapped to architecture
Consult with affected groups	⚠️ PARTIAL	30-day consultation designed. No live consultation conducted (no deployment).
Submit to national competent authority	❌ NOT STARTED	Requires deployment context and named authority. Human gate.
Notify MSA of assessment outcome	❌ NOT STARTED	Requires deployment context. Human gate.
Make FRIA publicly available	✅ MET	Publication protocol designed. This page is the public methodology.
Update when system materially changes	✅ MET	SIGIL versioning triggers FRIA refresh on model/architecture change

Cross-Framework Alignment

Framework	Article	Requirement	DEFONEOS Mapping
EU AI Act	Art 27	FRIA for high-risk deployers	This page — 5-phase methodology
EU AI Act	Art 86	Right to explanation	FRIA Phase 4 → explanation framework
GDPR	Art 35	Data Protection Impact Assessment	Conducted in parallel with FRIA
ECHR	Arts 2,6,8,13,14	Convention rights protection	Phase 2: 12 rights mapped to ECHR
EU Charter	Arts 1,7,8,21,24,41,47	Fundamental rights of the EU	Phase 2: Charter articles in rights register
Equality Act 2010	s.149	Public Sector Equality Duty	Integrated into FRIA Phase 5 consultation
UNCRC	Arts 2,3,6,12	Children's rights	Children's Rights Impact Assessment within FRIA
HRA 1998	s.6	Public authority compatibility duty	FRIA is the compliance evidence
UK DPA 2018	Sch.1 Pt.2	Safeguards for substantial public interest	FRIA satisfies safeguard requirement
ISO 42001	Cl. 6.1	Risks and opportunities	Phase 3 risk scoring aligned
NIST AI RMF	Measure 2.1	Assess impacts on individuals	Phase 2 rights impact identification

Integration with DEFONEOS Architecture

The FRIA is not a one-time document. It is a living governance instrument that is continuously informed by the DEFONEOS operational stack:

SIGIL chain → Feeds FRIA review with real-world impact data
Bias monitoring → Updates risk scores with measured fairness metrics
Incident response → Triggers immediate FRIA review on SERIOUS+ incident
Right to explanation → FRIA defines which decisions require explanation tiers
Red line enforcement → FRIA defines what constitutes a red line breach
BFT council → FRIA acceptance requires quorum vote; review changes require re-vote

⚠️ Honesty Register

The FRIA methodology described here is the designed framework. No live FRIA has been conducted for a real DEFONEOS deployment — there is no live deployment. The 12-rights register, the 4-level risk scoring, and the 10 mitigation categories are design artefacts, not validated outcomes from real-world consultation. The 30-day public consultation has not occurred. No national competent authority has been notified. No civil society feedback has been collected. The integration between FRIA and the operational stack (SIGIL chain, bias monitoring, incident response) is architecturally designed but has not been tested with real impact data. The claim that "FRIA is the foundation of the rights-by-design architecture" is aspirational — the architecture was designed first, and the FRIA framework was built to formalise and document the rights protections that the architecture already provides. A genuinely rights-led process would have started with the FRIA and designed the system around it — DEFONEOS did both simultaneously, which is defensible but should be acknowledged. No DPO has been formally designated. No equality body has been consulted.