What assessments are required under the EU’s AI Act?
What assessments are required under the EU’s AI Act?
The new European Union Artificial Intelligence Act (“the Act”), which was recently approved by the European Parliament, brings with it numerous compliance obligations for organisations developing and/or using artificial intelligence (“AI”). Two of those obligations include the legal requirements to conduct Fundamental Rights Impact Assessment (“FRIA”) and Conformity Assessments (“CA”). In this blog, we explore what this means for organisations that will be subject to these requirements and what assessments are required under the EU’s AI Act.
As seen below, there are similarities between FRIAs and CAs but some of the key differences include:
- Who is responsible for conducting the assessment (i.e. the deployer, provider, manufacturer, distributor or importer);
- What the assessment covers (i.e. assessing compliance with fundamental rights or assessing compliance with EU Directives relating to standards as well as the provisions of the Act); and
- What actions are required following the assessments (i.e. registering the outcome of the assessment with the surveillance authority or affixing a CE mark on the product).
Both processes are detailed and complex and the interpretation of the relevant sections of the Act will become clearer as official guidance and templates are published. The following is a ‘light-touch’ overview of what to expect.
Download your free copy of
Fundamental Rights Impact Assessment (“FRIA”)
A FRIA is a risk assessment that is designed to protect the fundamental rights of individuals. Many of us will be familiar with Data Protection Impact Assessments (“DPIAs”), a requirement under Article 35 of the General Data Protection Regulation (“GDPR”) and, whilst FRIAs and DPIAs do share some similarities, there are also significant differences. In particular, FRIAs have a much broader application than DPIAs. This is because DPIAs focus on risks that can arise as a result of processing personal data, whereas FRIAs include, not just the fundamental right to the protection of personal data, but all other fundamental rights as well, as mentioned under the Charter of Fundamental Rights, including the right to freedom of expression, the right to education, the right to equality, the right to justice etc.
When is a FRIA required?
A FRIA needs to be conducted before the AI system is implemented. Therefore, the responsible party needs to ensure that the FRIA is completed prior to putting their new system into use.
What AI does a FRIA apply to?
A FRIA is legally required for certain high-risk AI systems. However, it is not required for ALL high-risk systems, as different obligations apply, depending on the particular type of high-risk AI system (see also the exemption below).
The relevant legislation is set out within Article 27 and Annex III of the Act. This law provides that a FRIA needs to be carried out for certain high-risk AI systems (for a definition of high-risk AI systems see our previous blog The EU AI Act | Does It Apply To Your Organisation that involve the following (subject to certain criteria being satisfied):
- Biometrics
- Education and vocational training
- Employment, workers management and access to self-employment
- Access to and enjoyment of essential private services and essential public services and benefits
- Law enforcement
- Migration, asylum and border control management
- Administration of justice and democratic processes
Are any high-risk AI systems exempt from FRIAs?
Article 27 of the Act provides that a FRIA is not required for those AI systems referred to in point 2 of Annex III of the Act. In particular, a FRIA is not required for critical infrastructure, that is, AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic or in the supply of water, gas, heating or electricity.
Who needs to conduct a FRIA?
Article 27 of the Act, provides that it is the responsibility of a deployer to conduct a FRIA. In broad terms, a deployer is an organisation that implements (deploys) the AI system (except where that use is in a personal capacity, in which case no FRIA is required). For example, an organisation that introduces a chatbot on its website would be classed as a deployer.
However, the requirement does NOT apply to all deployers. It only applies to the following types of deployers:
- Bodies governed by public law;
- Private entities providing public services;
- Deployers of AI systems intended to be used for evaluating someone’s creditworthiness or to establish their credit score (unless the system is used to detect fraud); and
- Deployers of AI systems used for assessing the risk of providing life insurance or health insurance to someone and the cost of this.
What needs to be included in a FRIA?
The legislation requires that a FRIA must include a description of:
- The deployer’s processes and purposes;
- The period of time over which the AI system is intended to be used;
- How frequently the AI system is intended to be used;
- The categories of people or groups who are likely to be affected by the use of the AI system;
- The specific risks of harm likely to impact the categories of individuals or groups mentioned above;
- The human oversight measures which will be implemented; and
- The measures that will be taken in the event that the risks materialise, including internal governance and a complaints process.
Considering the elements that need to be included in a FRIA, the assessment shares some similarities to a DPIA such as:
- Describing the processing;
- Identifying and assessing the risks; and
- Describing how those risks will be mitigated.
In order to assist with the FRIA process, the Artificial Intelligence Office (“AI Office”) will issue a template for organisations to use. However, this has not been published yet.
It is worth noting that Article 27(2) of the Act provides that deployers are entitled to rely on a previously conducted FRIA or an existing impact assessment conducted by the provider of the AI System, providing the assessment is updated, as necessary. This will save deployers time and effort in circumstances where assessments have already been carried out, thereby, avoiding a duplication of work.
What action is required after the FRIA has been completed?
Once the FRIA has been carried out, Article 27(3) of the Act provides that, the deployer must notify the market surveillance authority of the results of the FRIA.
Timeline
FRIAs are expected to become a legal requirement in July 2026, when Article 27 of the Act enters into force.
Conformity Assessments
What is a Conformity Assessment?
A Conformity Assessment is a legal obligation under Article 43 of the Act and is a way of “…demonstrating the compliance of a high-risk AI system…” with Chapter III Section 2 of the legislation. In other words, a Conformity Assessment is a framework of technical and non-technical assessments that are required to show that the applicable provisions of the Act have been complied with in relation to the high-risk AI System in question including:
- Establishing a risk management system;
- Data Governance;
- Technical documentation;
- Keeping records;
- Ensuring transparency;
- Ensuring human oversight; and
- Ensuring that the AI system is accurate, robust and that it has an appropriate level of cybersecurity in place.
What AI does a Conformity Assessment apply to?
Conformity Assessments apply to the high-risk AI Systems set out within Annex III to the Act which includes the following (subject to certain criteria being satisfied):
- Biometrics
- Critical Infrastructure
- Education and vocational training
- Employment, workers management and access to self-employment
- Access to and enjoyment of essential private services and essential public services and benefits
- Law enforcement
- Migration, asylum and border control management
- Administration of justice and democratic processes
When is a Conformity Assessment required?
A Conformity Assessment must be completed before the high-risk AI system is put on the market or ‘goes live’ and a new Conformity Assessment must be carried out if any changes to the AI system are implemented that could affect its compliance or if the purpose of the AI system changes.
Are any High-risk AI systems exempt from Conformity Assessments?
The Act provides that in some scenarios, a Conformity Assessment does not need to be carried out. However, this derogation is very limited and is only permitted in circumstances where there are exceptional reasons of public security or the protection of life and health of persons, environmental protection or the protection of key industrial and infrastructural assets. In any event, the derogation only lasts for a very limited period to allow time for the necessary conformity assessment procedures to be carried out, which must then be undertaken without undue delay.
Who needs to conduct a Conformity Assessment?
In most cases, the Conformity Assessment will be carried out by the provider of the high-risk AI System. However, manufacturers, distributors and importers need to conduct the Conformity Assessments in the following circumstances:
- Manufacturers – A manufacturer will need to conduct a Conformity Assessment if the AI system is offered on the market under the manufacturer’s name or if the AI System contains safety components of products covered by the EU harmonisation legislation.
- Distributors and Importers –A distributor or importer will need to conduct a Conformity Assessment if the AI System is offered on the market under their name or trademark or they modify the provider’s intended purpose of the AI system or otherwise make significant modifications such that it is a high-risk AI System.
How to conduct a Conformity Assessment
There are two options for conducting Conformity Assessments, namely, internally or via external verification.
Internal Conformity Assessments
If the responsible party can show that they have adhered to “harmonised” standards, as referred to within Article 40 of the Act, an internal Conformity Assessment will suffice. “Harmonised” standards are standards which have been recognised across the EU in relation to various products and a list of the Directives relating to those standards can be found within Annex I of the Act, which includes a long list of safety standards for products such as toys, motor vehicles, marine equipment and lifts.
An internal Conformity Assessment is, as the name suggests, carried out by the responsible party themselves, internally. The procedure is set out within Annex VI of the Act and involves:
- Verifying that the quality management system for the AI System is compliant;
- Examining the technical documentation and to assess compliance; and
- Verifying that the design, development and monitoring of the AI System are compliant.
Once the above has been completed, the responsible party is required to prepare a Declaration of Conformity and maintain it for 10 years after the AI System has been placed on the market or put into service. They must also to affix the CE mark to the product indicating that it can be used throughout the EU.
External Conformity Assessments
If the responsible party is unable to rely on harmonised standards, it will be necessary for them to arrange for an external Conformity Assessment carried out by a third party, the procedure for which is set out within Annex VII of the Act. This involves an assessment being carried out by a body designated by the Commission to ensure that the AI System is compliant. If the AI System is found to be compliant, a certificate will be issued which will contain the conclusions of the examination, any conditions to which the certificate is subject and the data necessary to identify the AI System.
Following this, the responsible party is required to follow the same procedure as with the internal assessment i.e prepare a Declaration of Conformity and maintain it for 10 years after the AI System has been placed on the market or put into service. They must also affix the CE mark to the product indicating that it can be used throughout the EU.
If the AI System is found to be non-compliant, the certificate will not be issued and the responsible party will be informed of the reasons why the certificate was refused.
Timeline
Conformity Assessments are expected to become a legal requirement in July 2026, when Article 43 of the Act enters into force.
Next steps
Arguably, there is still have plenty of time to fully absorb and understand how the relevant provisions of the Act will apply in practice. However, in view of the complexity of this new law, we would advise starting the process as soon as possible.
If you would like any help in understanding the different types of assessments required when developing or procuring an AI tool business or you would like to discuss how we can support your organisation from an AI governance perspective, please get in touch using the form below or visit our AI Governance Services page.
