The Dutch Data Protection Authority (AP) anticipates the entry into force of the AI Regulation by informing organizations of their future obligation to carry out a fundamental rights impact assessment (FRIA).

From December 2027, public bodies as well as private entities providing public services or using financial risk assessment systems will have to carry out this assessment before deploying a high-risk AI system. This assessment aims to map out in advance the potential consequences on fundamental rights, such as equal treatment, human dignity, or privacy, and to describe the measures planned to mitigate these risks. The AP emphasizes that the FRIA complements the data protection impact assessment (DPIA) by adopting a broader scope than just the protection of personal data.

Although the obligation will only apply in 2027, the AP recommends organizations to prepare now. To assist them, it is launching a pilot project allowing participants to familiarize themselves with the European FRIA report model and receive feedback on their approach. This project is not a control or sanction procedure. Applications are open until 21 September 2026 for a start in early October. The authority specifies that this initiative is the first in a series of publications aimed at preparing organizations for their future obligations.