A new note prepared for the European Commission sets out how researchers and ethics reviewers should assess the impact of AI on fundamental rights in EU-funded projects. The method goes beyond data protection and is aligned with the AI Act.

‍
The Research Ethics and Integrity Team of the Commission’s Directorate-General for Research and Innovation has just released Fundamental Rights Impact Assessment (FRIA) and AI – Ethics advice for researchers and ethics experts, a note dated May 2026. The document was prepared by expert Alessandro Mantelero, with the coordination of Mihalis Kritikos. It is intended for applicants and beneficiaries of Horizon Europe and other EU-funded programmes, and for the experts who review their proposals.

The note is not official EU guidance and cannot anticipate the outcome of any ethics appraisal. It is, however, a clear signal of how the assessment of AI-based research is evolving.

‍
Why a fundamental rights impact assessment
AI is increasingly used in research to study individuals and societies, and to develop tools for decision-makers in fields ranging from welfare to crime prevention. Its potential impact goes well beyond privacy: an AI system for personalised medicine may affect the right to health and non-discrimination, and an educational robot may affect the rights of the child and freedom of thought.
The traditional EU ethics review already considers some fundamental rights, especially data protection. But according to the note, the Data Protection Impact Assessment (DPIA) cannot fully capture the impact of AI. It tends to read every right through data protection categories, and in practice it pays limited attention to other rights.
The note also warns against two opposite risks: turning fundamental rights into mere ethical values, and treating legal compliance as the only test of whether a use of AI is acceptable. Ethics review and fundamental rights assessment remain complementary.

‍
What a FRIA is
The note identifies the main features of a FRIA:
• A prior assessment. Unlike human rights impact assessments in business, which are often a response to problems that have already emerged, a FRIA must be carried out before an AI solution is adopted.
• Values-oriented. Fundamental rights cannot be traded off against economic interests or efficiency gains.
• Contextual. The same AI system can have very different impacts depending on where and how it is used.
• Expert-based. It cannot be reduced to a questionnaire and requires both fundamental rights and AI expertise.
Its three functions are awareness raising, risk analysis and risk management. The first concerns researchers themselves; the other two require fundamental rights experts where this expertise is not in the team.

‍
The methodology in three steps
1. Planning, scoping and risk identification. Describe the AI system, its data flows and its context of use; identify the people and groups potentially affected and the rights at stake. A key question comes first: is AI really necessary, or are there alternatives? The note suggests a SWOT analysis for this.
2. Risk analysis. For each right potentially affected, a risk index combines two dimensions. Likelihood is the combination of the probability of adverse outcomes and the exposure of the people concerned. Severity is the combination of the gravity of the prejudice and the effort needed to overcome and reverse it.
3. Risk management and monitoring. Identify measures to prevent or mitigate the risks, implement them and monitor the system over its life cycle, revising the assessment when technology or context change.
The note recommends qualitative risk matrices rather than numerical scores, with levels from low to very high. A 4x4 matrix is suggested as the most appropriate. Each right must be assessed separately: a low impact on one right cannot compensate for a high impact on another. Any balancing with competing interests, or legal requirements that justify an impact, are considered only after the impact on each right has been assessed.

‍
Participation and practical tools
Involving rights holders and stakeholders is presented as crucial: it helps researchers see issues from a different angle, increases trust in AI and supports co-design. The note also warns against “participation washing”.
The document includes two ready-to-use questionnaires, one for researchers and one for ethics reviewers. It also offers a table of examples of potential impacts of AI on fundamental rights and a case study on an AI system that uses medical images to predict patients’ response to chemotherapy. The system is trained on data from 5,000 patients in ten European countries and validated in eight healthcare centres worldwide.

‍
What it means beyond research
The methodology is designed for Horizon Europe ethics review, but it is explicitly aligned with the AI Act. Under Article 27 of the AI Act, certain deployers of high-risk AI systems, including public bodies and private entities providing public services, will have to carry out a fundamental rights impact assessment before using them. Following the Digital Omnibus on AI, these obligations will apply from 2 December 2027.
For research organisations, the note means that projects involving AI should plan a structured FRIA from the proposal stage, with the right expertise in the team. For companies and public administrations, it offers a concrete model for preparing the assessments the AI Act will require: a method that is documented, right by right, and capable of guiding design choices rather than simply recording risks.

Data Valley Consulting supports research organisations, companies and public administrations in assessing the impact of AI on fundamental rights, from ethics self-assessments in EU-funded projects to the impact assessments required by the AI Act.

‍