The Fundamental Rights Impact Assessment
The FRIA under the EU AI Act — the obligation that is most often skipped and most often asked for.
The Fundamental Rights Impact Assessment is the EU AI Act obligation most firms skip and most examiners ask for first. It is the one that asks whether the system should exist, not just whether it works.
The Fundamental Rights Impact Assessment (FRIA) is the EU AI Act obligation most often skipped and most often asked for. It is the obligation that asks whether a high-risk AI system should exist at all — what fundamental rights it affects, which populations it touches, what the foreseeable impacts are, and what the mitigations are. It is not a technical document; it is a rights document, and that is why technical teams skip it and why examiners ask for it first. A firm that has a model card and no FRIA has answered the question no one asked and left the first one blank.
We are pre-revenue and building the POC. This post maps the FRIA to the architecture we are building, and names it as a binding EU AI Act obligation throughout — not supervisory guidance, not voluntary. The manifest (BR-842) is built for the binding tier first; the FRIA is part of that tier for high-risk systems.
What the FRIA actually asks
The FRIA asks a firm to identify the fundamental rights affected by the system, the specific use case and context, the populations potentially affected, the foreseeable impacts on those populations, and the measures taken to mitigate adverse impacts. It is a rights assessment, not a model assessment — it asks what the system does to people, not what it does to data. The two overlap but are not the same: a model can have perfect data provenance and still violate a fundamental right if the use case is one the right protects. The FRIA is the obligation that catches that gap, which is why it is the one technical teams skip — the technical documentation does not surface it.
Where the manifest supports the FRIA
The manifest does not produce the FRIA; the FRIA is a rights assessment produced by people who understand the use case and the legal context. What the manifest provides is the substrate that makes the FRIA concrete: the input NodeVersions (L1 through L4 of the GNL) show what the system read, which means they show which populations the system touched; the agent trace shows which of the 23 A2A agents participated, which means they show which lenses were applied; the AxisOverride shows where a human intervened, which means it shows where oversight was exercised. The FRIA is the assessment; the manifest is the evidence the assessment operates on. A FRIA without evidence is a claim; a FRIA with the manifest is a claim grounded in a record.
The FRIA asks what the system does to people, not what it does to data. A model card does not surface that question; the FRIA is the obligation that does.
- The FRIA is a binding EU AI Act obligation for high-risk systems — not supervisory, not voluntary.
- It asks about rights, populations, and mitigations — what the system does to people, not to data.
- The manifest provides the evidence: which NodeVersions were read (populations), which agents ran (lenses), where overrides occurred (oversight).
- A FRIA without evidence is a claim; a FRIA grounded in the manifest is a claim a record supports.
Why it is the one most often skipped
The FRIA is skipped because it is not a technical document and technical teams are the ones who prepare the compliance submission. A model card is a technical document; a risk assessment is a risk document; a FRIA is a rights document, and it requires a different competency — legal, ethical, contextual — that the technical team does not always have. The result is a submission that has a model card, a risk assessment, and a gap where the FRIA should be. The examiner asks for the FRIA first because the FRIA is the obligation that determines whether the system should exist, and a firm that cannot answer that question has not done the work the Act requires — regardless of how good the model is.
What the FRIA does not replace and what does not replace it
The FRIA does not replace the risk assessment, the transparency obligations, or the model card; it is a separate obligation with a separate scope. The risk assessment is about the system; the FRIA is about the rights the system affects. The transparency obligations are about the output; the FRIA is about the population. None of them substitutes for the others, and a firm that treats the FRIA as a re-labeled risk assessment has not done a FRIA. The manifest supports all of them — the same record, different framings — but the framings are not interchangeable, and the honesty is in keeping them separate.
The FRIA is the obligation that asks whether the system should exist. A firm that has a model card and no FRIA has answered the question no one asked and left the first one blank.
— EU AI Act FRIA note
The honest scope
We are building the POC, pre-revenue. The manifest attests provenance and reproducibility — never truth, and never a rights assessment. The FRIA is a binding obligation that the firm produces; the manifest is the evidence the firm grounds it in. Calibration of the underlying model is a separate, gated loop (Gate 1b). The manifest is the audit story; the calibration loop is the accuracy story; the FRIA is the rights story. Three records, one substrate, and the honesty is in keeping them separate — because that is what the Act asks for, and what an examiner reads as a firm that has read the Act.