5 common FRIA mistakes that will not survive a regulatory review
Fundamental Rights Impact Assessments often fail regulatory scrutiny because of avoidable errors. These are the five most common mistakes and how to fix them before submission.
Mistake 1: Copy-pasting the DPIA
The FRIA and DPIA serve different purposes. A DPIA assesses data protection risks under GDPR; the FRIA addresses fundamental rights broadly — including non-discrimination, access to education, fair trial, and social security. Simply copying your DPIA and relabelling it as a FRIA will leave major gaps. The FRIA must address rights beyond data protection and consider the specific deployment context, affected populations, and societal impacts.
Fix: Use your DPIA as a starting point (Article 27(4) encourages this), but layer on analysis for each potentially affected fundamental right. Map your AI system's outputs to the Charter of Fundamental Rights and assess impact for each applicable right.
Mistake 2: Ignoring indirect and cumulative impacts
Many FRIAs only consider direct, individual-level impacts — for example, one person being wrongly denied credit. But regulators expect you to assess cumulative and systemic effects: What happens when thousands of decisions compound? Does the system disproportionately affect a protected group over time?
Fix: Include both individual and population-level analysis. Use demographic breakdowns if available. If the system is deployed at scale, model the cumulative impact on affected groups and document how monitoring will detect emerging patterns.
Mistakes 3–5: Weak mitigation, no update plan, missing notification
Mistake 3: Listing generic mitigations ('human oversight will be applied') without specifying how, when, and by whom. Every mitigation must be operationally concrete with assigned responsibility. Mistake 4: Treating the FRIA as a one-time document. The FRIA must be updated when the system changes significantly or when the deployment context evolves — this is not optional.
Mistake 5: Failing to notify the market surveillance authority. Article 27(5) requires the deployer to submit the FRIA results — not just keep them on file. Missing this step can trigger enforcement action even if the FRIA itself is well-prepared. ActLoom tracks all five of these requirements and alerts you when a FRIA review is overdue or a notification has not been sent.