Two machines, one market gate
A high-risk AI system does not simply ship. Someone has to assess it before it goes live, and someone has to declare it conforms before it goes to market. The EU AI Act splits this cleanly: deployers of certain systems may owe a fundamental rights impact assessment (FRIA) before first use, and providers must pass a conformity assessment, sign a declaration, affix a CE mark, and register the system. This session keeps those two straight and turns each into a checklist you can run.
The fundamental rights impact assessment 9 min live
The FRIA (Article 27) is a deployer obligation, not a provider one. It falls on public bodies and on deployers of certain Annex III systems, and it is done before the system is first used. It is the deployer asking, in writing, "what could this do to the people it touches, and how will we catch it?"
LiveWho owes a FRIA, and when3 min▶
- Public bodies and public-service providers deploying a high-risk system owe a FRIA.
- Deployers of certain Annex III systems owe one too - notably creditworthiness / credit scoring (point 5(b)) and life and health insurance risk assessment and pricing (point 5(c)).
- Timing: before the first use of the system. It is a pre-deployment gate, not an after-the-fact write-up.
- Filing: the deployer notifies the market surveillance authority of the results, using a template provided by the AI Office.
LiveWhat the FRIA must describe3 min▶
The assessment is concrete. It sets out:
- The deployment processes - how the deployer will actually use the system, in context.
- The usage timeframe and frequency - how long and how often it runs.
- The categories of affected persons - who is on the receiving end.
- The specific risks of harm to those people - named, not generic.
- Human-oversight measures - how a person stays in the loop.
- Governance and complaint mechanisms - what happens when something goes wrong, and how affected people raise it.
Self-studyFRIA vs the provider's Article 9 system2 min▶
Do not merge these. The provider runs a risk-management system under Article 9 across the whole lifecycle of the high-risk system - identifying, evaluating, and mitigating risks in the product itself. The deployer's FRIA under Article 27 is narrower and downstream: it looks at fundamental-rights impacts in this deployment context. A provider's Article 9 work does not discharge a deployer's FRIA, and vice versa. When the same organisation is both, it does both - and can reuse evidence, but must not pretend one covers the other.
Conformity, CE, registration 9 min live
Before a high-risk system reaches the market, the provider walks a fixed path: assess conformity, sign an EU declaration of conformity, affix the CE marking, and register the system in the EU database. Most Annex III systems self-assess; a narrow slice needs a notified body.
LiveSelf-assessment vs notified body3 min▶
- Self-assessment is the default. For high-risk systems in Annex III points 2 to 8, the conformity assessment is internal control under Annex VI - the provider assesses its own conformity against the requirements.
- Third-party for biometrics without standards. For Annex III point 1 (biometrics), where harmonised standards or common specifications are absent, a notified body runs the assessment under Annex VII.
- Substantial modification re-triggers. Change the system substantially after assessment and you must assess conformity again. Governance is continuous, not a one-time stamp.
LiveDeclaration, CE mark, and the register3 min▶
Once conformity is assessed, three steps take the system to market, all before it is placed on the market:
- EU declaration of conformity (Article 47) - the provider signs a formal statement that the system meets the requirements, and keeps it available.
- CE marking (Article 48) - the familiar mark is affixed, signalling conformity, as for other regulated products.
- EU database registration (Article 49) - the provider registers the high-risk system in the EU database before market. Certain law-enforcement and migration systems register in a non-public section of that database.
Self-studyVantage vs its credit-scoring cousin2 min▶
The two machines land differently depending on where you sit in the value chain, which is exactly what trips teams up.
Vantage's hiring tool: the provider path, no FRIA. As the provider of a high-risk Annex III(4) employment system, Vantage self-assesses conformity under Annex VI, signs an EU declaration of conformity, affixes the CE mark, and registers the system before it goes to market. It does not owe a FRIA - that duty sits with the employer who deploys it. But if Vantage built the credit-scoring cousin its roadmap flirts with (Annex III point 5(b)), any deployer of that system would owe a FRIA before first use. Same company, different obligations, driven by role and use case - map both before you ship either.
Map Vantage's pre-market path ★ 10 min · checklist
Turn the mechanism into a route for one system. Map Vantage's path and decide the FRIA question.
Conformity route. Confirm the tier (high-risk, Annex III(4)) and pick the route: self-assessment under Annex VI, since it is not point-1 biometrics.
Declaration + CE. Note the EU declaration of conformity (Art 47) and the CE marking (Art 48) as the next two steps before market.
Registration. Register the system in the EU database (Art 49) before placing it on the market.
FRIA decision. Decide: does Vantage, as provider, owe a FRIA? No. Then note who would - the deploying employer, and, for the credit-scoring cousin, its deployer.
Before session b8 ◐ 40 min total
- For one high-risk system, map its pre-market path: conformity route, declaration, CE mark, registration.
- Decide whether you are the provider, the deployer, or both - and write down which of the FRIA and Article 9 duties that creates.
- List one plausible "substantial modification" to your system and note that it would re-trigger conformity assessment.
- Read: EU AI Act Articles 27, 43, and 47 to 49, plus Annex VI and Annex VII.
Official sources covered
Taught from the EU AI Act text. This page covers ~80% of the working content on assessment and conformity.
Three questions before you go 🎯 ◐ 90 seconds
1 · A fundamental rights impact assessment (Article 27) is primarily an obligation of the...
The FRIA is a deployer duty done before first use. It falls on public bodies and deployers of certain Annex III systems such as credit scoring and insurance - distinct from the provider's Article 9 risk-management system.
2 · For most high-risk Annex III systems (points 2 to 8), the default conformity assessment is...
Self-assessment (Annex VI) is the default for Annex III points 2 to 8. A notified body (Annex VII) is required for point-1 biometrics where harmonised standards or common specifications are absent.
3 · Put the provider's pre-market steps in order after conformity assessment.
After assessing conformity: sign the EU declaration of conformity (Art 47), affix the CE marking (Art 48), then register in the EU database (Art 49) - all before the system is placed on the market.