Fundamental Rights Impact Assessment

EU AI Act Article 27 requires deployers of high-risk AI systems to conduct a Fundamental Rights Impact Assessment (FRIA) before putting the system into use. MeshAI provides structured FRIA creation, storage, and versioning.

When Is a FRIA Required?

A FRIA is required when:

The agent is classified as high or unacceptable risk
The agent is used by a public body or private entity providing public services
The agent performs profiling of natural persons

Required Fields

Article 27(1) specifies six assessment areas (a–f). MeshAI enforces all six, plus who assessed the agent:

Field	Article 27(1) Reference	Description
`intended_purpose`	Art. 27(1)(a)	The system’s intended purpose
`processes_description`	Art. 27(1)(a)	Description of the deployer’s processes in which the AI system will be used
`usage_period`	Art. 27(1)(b)	Period of intended use
`usage_frequency`	Art. 27(1)(b)	How often and how extensively the system will be used
`affected_categories`	Art. 27(1)(c)	List of categories of natural persons and groups likely to be affected
`specific_risks`	Art. 27(1)(d)	List of specific risks of harm likely to impact the identified categories
`human_oversight_measures`	Art. 27(1)(e)	Description of human oversight measures implemented
`risk_mitigation_measures`	Art. 27(1)(f)	Actions to be taken if risks materialize
`complaint_mechanisms`	Art. 27(1)(f)	How affected persons can file complaints
`internal_governance`	Art. 27(1)(f)	Internal governance arrangements for risk materialization
`assessed_by`	Metadata	Who performed the assessment

Create a FRIA

curl -X POST https://api.meshai.dev/api/v1/agents/01ARZ3NDEKTSV4RRFFQ69G5FAV/fria \
  -H "Authorization: Bearer msh_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "intended_purpose": "Rank job applicants for open HR positions",
    "processes_description": "The AI agent reviews job applications and ranks candidates for the HR team. It processes CVs, cover letters, and assessment results.",
    "usage_period": "Ongoing, reviewed quarterly",
    "usage_frequency": "Daily, by 5 HR managers, ~500 applications/month",
    "affected_categories": ["Job applicants"],
    "specific_risks": ["Discriminatory bias in candidate ranking based on gender, age, ethnicity, or disability"],
    "human_oversight_measures": "All AI-ranked lists are reviewed by a human HR manager before any hiring decision. The agent cannot reject candidates - it only suggests rankings.",
    "risk_mitigation_measures": "If bias is detected: immediately suspend the agent, notify affected applicants, and conduct manual review of all affected applications.",
    "complaint_mechanisms": "Applicants may email hr-appeals@company.com to request manual review of their ranking.",
    "internal_governance": "The DPO reviews quarterly bias audits and signs off on continued use.",
    "assessed_by": "user@company.com"
  }'

from meshai import MeshAI

client = MeshAI(api_key="msh_...")

fria = client.create_fria(
    agent_id="01ARZ3NDEKTSV4RRFFQ69G5FAV",
    intended_purpose="Rank job applicants for open HR positions",
    processes_description="The AI agent reviews job applications and ranks candidates...",
    usage_period="Ongoing, reviewed quarterly",
    usage_frequency="Daily, by 5 HR managers, ~500 applications/month",
    affected_categories=["Job applicants"],
    specific_risks=["Discriminatory bias in candidate ranking"],
    human_oversight_measures="All AI-ranked lists reviewed by a human HR manager...",
    risk_mitigation_measures="If bias is detected: suspend agent, notify affected applicants...",
    complaint_mechanisms="Applicants may email hr-appeals@company.com...",
    internal_governance="The DPO reviews quarterly bias audits...",
    assessed_by="user@company.com",
)

{
  "success": true,
  "data": {
    "id": 7,
    "agent_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
    "version": 1,
    "intended_purpose": "Rank job applicants for open HR positions",
    "processes_description": "The AI agent reviews job applications and ranks candidates...",
    "usage_period": "Ongoing, reviewed quarterly",
    "usage_frequency": "Daily, by 5 HR managers, ~500 applications/month",
    "affected_categories": ["Job applicants"],
    "specific_risks": ["Discriminatory bias in candidate ranking"],
    "human_oversight_measures": "All AI-ranked lists reviewed by a human HR manager...",
    "risk_mitigation_measures": "If bias is detected: suspend agent, notify affected applicants...",
    "complaint_mechanisms": "Applicants may email hr-appeals@company.com...",
    "internal_governance": "The DPO reviews quarterly bias audits...",
    "assessed_by": "user@company.com (key:a1b2c3d4)",
    "status": "draft",
    "submitted_at": null,
    "created_at": "2026-03-17T10:00:00Z"
  }
}

assessed_by is bound to the authenticated API key (a (key:...) suffix is appended) to prevent identity spoofing.

Submit a FRIA

After review, submit the FRIA to mark it as finalized:

curl -X POST https://api.meshai.dev/api/v1/fria/7/submit \
  -H "Authorization: Bearer msh_YOUR_API_KEY"

client.submit_fria(fria_id=7)

Submitting a FRIA changes its status from draft to submitted and sets submitted_at. Submitting an already-submitted FRIA returns a conflict error.

Get / List FRIAs

# Latest FRIA for an agent
curl https://api.meshai.dev/api/v1/agents/01ARZ3NDEKTSV4RRFFQ69G5FAV/fria \
  -H "Authorization: Bearer msh_YOUR_API_KEY"

# List, optionally filtered by agent_id / status
curl "https://api.meshai.dev/api/v1/fria?agent_id=01ARZ3NDEKTSV4RRFFQ69G5FAV&status=submitted" \
  -H "Authorization: Bearer msh_YOUR_API_KEY"

fria = client.get_fria("01ARZ3NDEKTSV4RRFFQ69G5FAV")
frias = client.list_frias(agent_id="01ARZ3NDEKTSV4RRFFQ69G5FAV", status="submitted")

Versioning

FRIAs are immutable once created - there is no update endpoint. To reassess an agent, create a new FRIA for the same agent; it is stored as the next incrementing version, and prior versions are preserved and retrievable via GET /fria.

curl -X POST https://api.meshai.dev/api/v1/agents/01ARZ3NDEKTSV4RRFFQ69G5FAV/fria \
  -H "Authorization: Bearer msh_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "intended_purpose": "...", "processes_description": "...", "usage_period": "...", "usage_frequency": "...", "affected_categories": ["..."], "specific_risks": ["Updated risk assessment after bias audit"], "human_oversight_measures": "...", "risk_mitigation_measures": "...", "complaint_mechanisms": "...", "internal_governance": "...", "assessed_by": "user@company.com" }'

This creates version 2 for the agent; version 1 remains available via GET /fria?agent_id=....

Getting Started

Proxy (Zero-Code)

Framework Guides

Governance

EU AI Act Compliance

Billing

Fundamental Rights Impact Assessment

When Is a FRIA Required?

Required Fields

Create a FRIA

Submit a FRIA

Get / List FRIAs

Versioning

​When Is a FRIA Required?

​Required Fields

​Create a FRIA

​Submit a FRIA

​Get / List FRIAs

​Versioning

When Is a FRIA Required?

Required Fields

Create a FRIA

Submit a FRIA

Get / List FRIAs

Versioning