> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meshai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Fundamental Rights Impact Assessment

> Article 27 FRIA - structured assessment of AI impact on fundamental rights

EU AI Act Article 27 requires deployers of high-risk AI systems to conduct a **Fundamental Rights Impact Assessment (FRIA)** before putting the system into use. MeshAI provides structured FRIA creation, storage, and versioning.

## When Is a FRIA Required?

A FRIA is required when:

* The agent is classified as **high** or **unacceptable** risk
* The agent is used by a public body or private entity providing public services
* The agent performs profiling of natural persons

## Required Fields

Article 27(1) specifies six assessment areas (a–f). MeshAI enforces all six, plus who assessed the agent:

| Field                      | Article 27(1) Reference | Description                                                                 |
| -------------------------- | ----------------------- | --------------------------------------------------------------------------- |
| `intended_purpose`         | Art. 27(1)(a)           | The system's intended purpose                                               |
| `processes_description`    | Art. 27(1)(a)           | Description of the deployer's processes in which the AI system will be used |
| `usage_period`             | Art. 27(1)(b)           | Period of intended use                                                      |
| `usage_frequency`          | Art. 27(1)(b)           | How often and how extensively the system will be used                       |
| `affected_categories`      | Art. 27(1)(c)           | List of categories of natural persons and groups likely to be affected      |
| `specific_risks`           | Art. 27(1)(d)           | List of specific risks of harm likely to impact the identified categories   |
| `human_oversight_measures` | Art. 27(1)(e)           | Description of human oversight measures implemented                         |
| `risk_mitigation_measures` | Art. 27(1)(f)           | Actions to be taken if risks materialize                                    |
| `complaint_mechanisms`     | Art. 27(1)(f)           | How affected persons can file complaints                                    |
| `internal_governance`      | Art. 27(1)(f)           | Internal governance arrangements for risk materialization                   |
| `assessed_by`              | Metadata                | Who performed the assessment                                                |

## Create a FRIA

<CodeGroup>
  ```bash curl theme={null}
  curl -X POST https://api.meshai.dev/api/v1/agents/01ARZ3NDEKTSV4RRFFQ69G5FAV/fria \
    -H "Authorization: Bearer msh_YOUR_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{
      "intended_purpose": "Rank job applicants for open HR positions",
      "processes_description": "The AI agent reviews job applications and ranks candidates for the HR team. It processes CVs, cover letters, and assessment results.",
      "usage_period": "Ongoing, reviewed quarterly",
      "usage_frequency": "Daily, by 5 HR managers, ~500 applications/month",
      "affected_categories": ["Job applicants"],
      "specific_risks": ["Discriminatory bias in candidate ranking based on gender, age, ethnicity, or disability"],
      "human_oversight_measures": "All AI-ranked lists are reviewed by a human HR manager before any hiring decision. The agent cannot reject candidates - it only suggests rankings.",
      "risk_mitigation_measures": "If bias is detected: immediately suspend the agent, notify affected applicants, and conduct manual review of all affected applications.",
      "complaint_mechanisms": "Applicants may email hr-appeals@company.com to request manual review of their ranking.",
      "internal_governance": "The DPO reviews quarterly bias audits and signs off on continued use.",
      "assessed_by": "user@company.com"
    }'
  ```

  ```python SDK theme={null}
  from meshai import MeshAI

  client = MeshAI(api_key="msh_...")

  fria = client.create_fria(
      agent_id="01ARZ3NDEKTSV4RRFFQ69G5FAV",
      intended_purpose="Rank job applicants for open HR positions",
      processes_description="The AI agent reviews job applications and ranks candidates...",
      usage_period="Ongoing, reviewed quarterly",
      usage_frequency="Daily, by 5 HR managers, ~500 applications/month",
      affected_categories=["Job applicants"],
      specific_risks=["Discriminatory bias in candidate ranking"],
      human_oversight_measures="All AI-ranked lists reviewed by a human HR manager...",
      risk_mitigation_measures="If bias is detected: suspend agent, notify affected applicants...",
      complaint_mechanisms="Applicants may email hr-appeals@company.com...",
      internal_governance="The DPO reviews quarterly bias audits...",
      assessed_by="user@company.com",
  )
  ```
</CodeGroup>

<ResponseExample>
  ```json Response theme={null}
  {
    "success": true,
    "data": {
      "id": 7,
      "agent_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
      "version": 1,
      "intended_purpose": "Rank job applicants for open HR positions",
      "processes_description": "The AI agent reviews job applications and ranks candidates...",
      "usage_period": "Ongoing, reviewed quarterly",
      "usage_frequency": "Daily, by 5 HR managers, ~500 applications/month",
      "affected_categories": ["Job applicants"],
      "specific_risks": ["Discriminatory bias in candidate ranking"],
      "human_oversight_measures": "All AI-ranked lists reviewed by a human HR manager...",
      "risk_mitigation_measures": "If bias is detected: suspend agent, notify affected applicants...",
      "complaint_mechanisms": "Applicants may email hr-appeals@company.com...",
      "internal_governance": "The DPO reviews quarterly bias audits...",
      "assessed_by": "user@company.com (key:a1b2c3d4)",
      "status": "draft",
      "submitted_at": null,
      "created_at": "2026-03-17T10:00:00Z"
    }
  }
  ```
</ResponseExample>

`assessed_by` is bound to the authenticated API key (a `(key:...)` suffix is appended) to prevent identity spoofing.

## Submit a FRIA

After review, submit the FRIA to mark it as finalized:

<CodeGroup>
  ```bash curl theme={null}
  curl -X POST https://api.meshai.dev/api/v1/fria/7/submit \
    -H "Authorization: Bearer msh_YOUR_API_KEY"
  ```

  ```python SDK theme={null}
  client.submit_fria(fria_id=7)
  ```
</CodeGroup>

Submitting a FRIA changes its status from `draft` to `submitted` and sets `submitted_at`. Submitting an already-submitted FRIA returns a conflict error.

## Get / List FRIAs

<CodeGroup>
  ```bash curl theme={null}
  # Latest FRIA for an agent
  curl https://api.meshai.dev/api/v1/agents/01ARZ3NDEKTSV4RRFFQ69G5FAV/fria \
    -H "Authorization: Bearer msh_YOUR_API_KEY"

  # List, optionally filtered by agent_id / status
  curl "https://api.meshai.dev/api/v1/fria?agent_id=01ARZ3NDEKTSV4RRFFQ69G5FAV&status=submitted" \
    -H "Authorization: Bearer msh_YOUR_API_KEY"
  ```

  ```python SDK theme={null}
  fria = client.get_fria("01ARZ3NDEKTSV4RRFFQ69G5FAV")
  frias = client.list_frias(agent_id="01ARZ3NDEKTSV4RRFFQ69G5FAV", status="submitted")
  ```
</CodeGroup>

## Versioning

FRIAs are immutable once created - there is no update endpoint. To reassess an agent, create a new FRIA for the same agent; it is stored as the next incrementing `version`, and prior versions are preserved and retrievable via `GET /fria`.

```bash theme={null}
curl -X POST https://api.meshai.dev/api/v1/agents/01ARZ3NDEKTSV4RRFFQ69G5FAV/fria \
  -H "Authorization: Bearer msh_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "intended_purpose": "...", "processes_description": "...", "usage_period": "...", "usage_frequency": "...", "affected_categories": ["..."], "specific_risks": ["Updated risk assessment after bias audit"], "human_oversight_measures": "...", "risk_mitigation_measures": "...", "complaint_mechanisms": "...", "internal_governance": "...", "assessed_by": "user@company.com" }'
```

This creates version 2 for the agent; version 1 remains available via `GET /fria?agent_id=...`.