EU AI Act Conformity Assessment and FRIA Process
Added June 2026
Implement applicable EU AI Act assessment requirements for high-risk systems. Prepare technical documentation, engage notified bodies where required, and address fundamental rights impact assessments.
Objective
Ensure high-risk AI systems deployed in the EU meet the EU AI Act's conformity obligations before going to market, including technical documentation standards, human oversight requirements, and fundamental rights impact assessment.
Maturity Levels
Initial
The organization is aware of EU AI Act obligations but has not assessed which systems are high-risk or begun conformity preparation.
Developing
High-risk systems have been identified. Technical documentation drafting is in progress but the conformity assessment process has not been defined.
Defined
A conformity assessment process is documented. Technical documentation exists for each high-risk system. The FRIA process is defined and has been run for at least one system.
Managed
All high-risk systems have completed technical documentation and FRIA. Notified body relationships are established for systems requiring third-party assessment. Post-market monitoring plans are operational.
Optimizing
Technical documentation is maintained continuously as systems change. FRIA findings feed into system design. The organization participates in EU AI Office stakeholder consultations.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 132 governance controls. Score your maturity on EU AI Act Conformity Assessment and FRIA Process and every other control, assign owners, and set deadlines.
- 132 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
Evidence Requirements
What an auditor or assessor would expect to see for this control.
- —High-risk system register identifying each system subject to EU AI Act high-risk classification, with classification rationale.
- —Technical documentation meeting Annex IV requirements for each high-risk system, with version date and sign-off.
- —Completed FRIA for each high-risk system deployed by a public authority or in a sensitive domain, with documented findings and mitigation plan.
Implementation Notes
Key steps
- Classify AI systems against the EU AI Act Annex III high-risk categories. Systems in biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and administration of justice require conformity assessment (a pre-market check against the Act's requirements).
- For each high-risk system, produce technical documentation meeting Article 11 and Annex IV requirements: system description, design specifications, training data governance, performance metrics, robustness and accuracy testing results, human oversight measures, and post-market monitoring plan.
- Determine the conformity assessment pathway:
- Most high-risk systems: internal conformity assessment with technical documentation lodged in an EU-accessible register.
- Biometric identification and law enforcement systems: assessment by a third-party notified body (an independent organization designated by an EU member state to assess compliance) required.
- Select a notified body if required. The EU AI Act's list of notified bodies was published from 2025. Engage early, notified bodies have limited capacity.
- Conduct a Fundamental Rights Impact Assessment (FRIA) for public authority deployers and private operators deploying high-risk systems with significant impact on individuals. The FRIA must assess impacts on dignity, non-discrimination, privacy, and data protection.
- Register the system in the EU AI Act database where required (all high-risk systems from 2026).
- Implement post-market monitoring (ongoing tracking of how the system performs once in use) as required by Article 72.
FRIA process steps
- Define the system scope and the affected population.
- Identify fundamental rights that could be affected: non-discrimination, privacy, dignity, freedom of expression, right to explanation.
- For each identified risk, assess severity and likelihood, and document existing mitigations.
- Where residual risks remain, define additional mitigations or human oversight requirements.
- Document the FRIA output and make it available to deployer compliance teams.
Example Implementation
EU AI Act Conformity Assessment Tracker
| System | Annex III Category | Assessment Pathway | Technical Doc Status | FRIA Required | FRIA Status | Notified Body | Reg. Database |
|---|---|---|---|---|---|---|---|
| Automated CV screening | Employment (8a) | Internal | Complete, v2.1 | Yes | Complete | N/A | Registered |
| Credit risk scoring | Essential services (5b) | Internal | In progress | Yes | Not started | N/A | Pending |
| Remote biometric ID | Biometrics (1b) | Third-party | Complete | Yes | Complete | [Notified Body X] | Registered |
| Benefits eligibility AI | Administration (8e) | Internal | Complete | Yes | In progress | N/A | Pending |