Part of the AI Regulation News hub.
The Autoriteit Persoonsgegevens published FRIA guidance and opened a national reporting pilot ahead of the December 2027 obligation
The fundamental rights impact assessment does not bind anyone until December 2027. The Dutch regulator is not waiting, and it is offering feedback on your draft in exchange for the practice experience.
Bottom line: The guidance and the pilot are not binding. The FRIA obligation itself is, and it starts in December 2027; participation in the pilot is voluntary and the AP states explicitly that it is not an audit, inspection or enforcement track.
Who this affects: DPOs, algorithm and AI governance leads, and legal counsel at Dutch government bodies and at private organisations delivering public services, plus any public or private organisation using a system that assesses financial risk.
Issue date: News item dated 17 August 2026; the page records a last update of 14 August 2026. Pilot registration closes 21 September 2026 and the pilot starts in early October.
What changed: The AP put out the first document in a planned series on AI and fundamental rights, and paired it with a live pilot on the European FRIA reporting template.
Analysis: The pilot is the AP building its own supervisory method in public. It says it will use participants' experience to improve its guidance, the template and its future supervisory approach, which means the people who join now are helping to write the standard they will later be measured against.
Primary sources: AP news item, 17 August 2026 · Aan de slag met de FRIA (PDF) · Uitnodiging pilot FRIA (PDF)
- Instrument (EN)
- Getting started with the FRIA, plus an invitation to a national FRIA reporting pilot
- Authority
- Autoriteit Persoonsgegevens (AP)
- Jurisdiction
- Netherlands
- Status
- Published; pilot open for registration
- Bindingness
- Non-binding guidance and a voluntary pilot; the underlying FRIA duty is binding from December 2027
- Issue date / next deadline
- 17 August 2026 / registration closes 21 September 2026, pilot starts early October 2026
- Relationship to the DPIA
- The AP describes the FRIA as an addition to the DPIA, not a replacement
- Primary source
- https://autoriteitpersoonsgegevens.nl/actueel/de-fria-voor-ai-systemen-komt-eraan-bereid-u-voor
Who has to do a FRIA, on the AP's description
The AP frames the duty by two routes. The first is institutional: you are a government organisation, or a private organisation delivering public services, and you intend to use a high-risk AI system. The second is functional and cuts across sectors: you are a public or private organisation about to use an assessment system for financial risks.
That second route is the one that surprises people. It does not depend on being part of government. Read as the AP writes it, an ordinary private firm running financial risk assessment falls inside the FRIA obligation.
The assessment itself is forward-looking. On the AP's account you map in advance what consequences the AI system may have for fundamental rights, naming equal treatment, human dignity, privacy and access to essential services, and you must also describe how you limit those risks and report on it to the supervisory authority.
What the pilot actually is
Participants work with the European template for FRIA reporting and get feedback on their approach. The AP calls the pilot a learning exercise and says in terms that it is emphatically not an audit, an inspection or an enforcement track at your organisation.
It is also not restricted to the experienced. The AP invites organisations with no prior background in fundamental rights assessments, on the reasoning that practical experience from the field is what makes the new obligation workable.
Registration runs to 21 September 2026, with the pilot starting in early October. The details on criteria and how to apply sit in the separate invitation document rather than in the news item.
FRIA and DPIA are not the same instrument
The AP is careful to distinguish the two. A DPIA looks at privacy risks in the processing of personal data. A FRIA looks more broadly at the possible consequences of deploying a high-risk AI system for all fundamental rights.
An organisation that already runs a mature DPIA process therefore cannot assume the work is done. The overlap is real, but the scope of the second assessment is wider by construction.
Sven Stevenson, the AP's director of Algorithm Coordination, puts the point in preventive terms: the mandatory FRIA forces organisations to think in advance about what an AI system means for the people who have to deal with it, which helps prevent problems instead of repairing them afterwards.
Why the AP is publishing this now
The AP is the coordinating supervisor for algorithms and AI in the Netherlands, and it says the government intends to designate it as the supervisor for the majority of high-risk AI systems falling under the AI Regulation. That designation is described as an intention, not a completed act.
The FRIA explainer is presented as the first document in a series on AI and fundamental rights with which the AP prepares organisations for their obligations under the Regulation. More documents are promised; none are dated.
The advice to start early is framed as self-interest rather than compliance theatre. Gaining experience now, the AP argues, gives you a better picture of the AI systems you actually use, which is a precondition for preparing for the obligations at all.
What we did not verify
We opened the AP news item of 17 August 2026 in Dutch and took every fact and quotation from it.
We did not open either linked PDF: not Aan de slag met de FRIA and not Uitnodiging pilot FRIA. The participation criteria, the application mechanics and the content of the guidance itself are therefore outside what we checked.
We do not claim that the AP has been designated as the supervisor for high-risk AI systems. The page says the cabinet intends to do so, and we report it at exactly that strength.
Two dates matter here and only one is an obligation. December 2027 is when the FRIA binds; 21 September 2026 is when the free feedback loop closes. If your organisation runs financial risk assessment or delivers public services with high-risk AI, the cheapest version of this work is the one where the regulator comments on your draft before it counts.
Source File
https://autoriteitpersoonsgegevens.nl/actueel/de-fria-voor-ai-systemen-komt-eraan-bereid-u-voor
Open the AP news item and confirm four things: the December 2027 start date, the two routes into the obligation including the financial risk assessment route, the statement that the pilot is not an audit or enforcement track, and the 21 September 2026 registration deadline.
De verplichte FRIA dwingt organisaties om vooraf stil te staan bij de vraag wat een AI-systeem betekent voor de mensen die ermee te maken krijgen. [The mandatory FRIA forces organisations to consider in advance what an AI system means for the people who have to deal with it.] ยท Sven Stevenson, Director of Algorithm Coordination, AP, 17 August 2026
FAQ
Is the FRIA obligatory now?
No. The AP states the obligation applies from December 2027. What is available now is guidance and a voluntary pilot, neither of which binds anyone.
Do private companies have to do a FRIA?
On the AP's description, yes in two situations: a private organisation delivering public services that intends to use a high-risk AI system, and any public or private organisation using a system that assesses financial risks.
Does joining the pilot expose us to enforcement?
The AP says the pilot is meant for learning and is emphatically not an audit, inspection or enforcement track at your organisation. That is the regulator's characterisation of its own exercise, and it is what the page commits to.
If we already run DPIAs, is that enough?
The AP treats the FRIA as an addition to the DPIA. A DPIA covers privacy risks in processing personal data; a FRIA covers the possible effects of a high-risk AI system on all fundamental rights.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.