Glossary term
FRIA
Also: Fundamental Rights Impact Assessment
Mandatory assessment under EU AI Act Art. 27 for deployment of specific high-risk AI systems. Required for public bodies and private deployers of essential services before first use.
Content: description of deployment, purpose, duration, frequency, affected groups, specific fundamental-rights risks, level of human oversight, mitigation measures including internal governance and complaint mechanisms.
Distinction from DPIA: FRIA focuses on fundamental-rights impact beyond data protection (discrimination, self-determination, fairness). DPIA focuses on data-protection risk under GDPR Art. 35. Both can complement each other.
In practice
Practice: FRIA is usually performed interdisciplinarily (legal, data protection, business, IT, compliance, potentially ethics board). The outcome must be documented before first deployment.
Related terms
EU AI Act
World's first comprehensive AI law. Four risk classes: prohibited, high-risk, limited (transparency), minimal. Phased application from February 2025 to August 2028.
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
DPIA
Mandatory assessment under GDPR Art. 35 where processing is likely to result in high risk to the rights and freedoms of natural persons. Required e.g. for systematic evaluation, large-scale processing of special categories and systematic monitoring of public areas.
FIDO2
Open authentication standard of FIDO Alliance and W3C, comprising WebAuthn (browser/platform interface) and CTAP2 (device protocol). Foundation for phishing-resistant MFA and Passkeys.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.