FRIA — Fundamental Rights Impact Assessment¶

EU AI Act Article 27 requires deployers of high-risk systems to assess the impact on fundamental rights before going live. The API creates a dossier pre-filled from a deployment-context template, lets you correct it section by section, attaches measured evidence from real traffic, and exports it as PDF/DOCX/JSON for submission.

Endpoints¶

Eleven routes on G-1 Studio under /v1/glad/fria. A dossier is identified by a FRIA-… id returned at creation.

Create a dossier¶

What it does. POST /v1/glad/fria creates an Article 27 dossier, pre-filled from a deployment context template. Pick the context that matches your use and the rights matrix, affected-group list and narrative defaults come populated; every section can then be overridden with the matching object.

curl -s -X POST http://localhost:8080/v1/glad/fria \
  -H "Content-Type: application/json" \
  -d '{
    "deployer_id":        "acme-corp",
    "system_name":        "Customer Support AI",
    "deployment_context": "general",
    "risk_classification":"high",
    "assessor_name":      "Maria Rossi"
  }' | jq '{fria_id, status, created_at}'

import httpx

c = httpx.Client(base_url="http://localhost:8080", timeout=60)

# Start from what the deployment already knows about itself.
draft = c.get("/v1/glad/fria/auto-prefill",
              params={"deployer_id": "acme-corp", "deployment_context": "general"}).json()

fria = c.post("/v1/glad/fria", json={
    "deployer_id": "acme-corp",
    "system_name": "Customer Support AI",
    "deployment_context": "general",
    "risk_classification": "high",
    "assessor_name": "Maria Rossi",
    # Rich Art. 27 sub-objects — supplying them is what turns the
    # generated PDF from a template into a submission-grade dossier.
    "affected_persons": {"groups": ["customers", "minors"]},
    "human_oversight": {"escalation": "Level-1 operator, then AI responsible."},
}).json()
fria_id = fria["fria_id"]

const fria = await fetch("http://localhost:8080/v1/glad/fria", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    deployer_id: "acme-corp",
    system_name: "Customer Support AI",
    deployment_context: "general",
    risk_classification: "high",
    assessor_name: "Maria Rossi",
  }),
}).then(r => r.json())

What comes back — the stored record, including its fria_id and the full record_json dossier with every Article 27 section pre-filled.

Request fields¶

Plus ten optional Article 27 sub-objects, each merged over its template defaults:

deployer · system · provider_art13 · process_description · deployment_period_frequency · affected_persons · risk_assessment · human_oversight · materialization_response · dpia_reference

Deployment contexts¶

An unrecognised value falls back to general rather than erroring.

Read and update¶

curl -s -X PUT http://localhost:8080/v1/glad/fria/FRIA-3F9A1C7B2E5D8046A1B2 \
  -H "Content-Type: application/json" \
  -d '{
    "next_review_date": "2027-06-10",
    "record_json": {
      "risk_assessment": {
        "right_to_privacy": {
          "probability": "medium",
          "severity": "low",
          "mitigation": "Data is pseudonymised and not stored beyond the session."
        }
      }
    }
  }'

Approve and archive¶

assessor_name is the only field the approve endpoint accepts — there is no approver and no notes. Record the reasoning in the dossier itself before approving.

Evidence¶

Two read endpoints. Neither one accepts an upload: evidence is not attached to a FRIA, it is derived from what the deployment already holds.

curl -s "http://localhost:8080/v1/glad/fria/FRIA-3F9A…/runtime-evidence?window_days=90" | jq

ev = c.get(f"/v1/glad/fria/{fria_id}/runtime-evidence", params={"window_days": 90}).json()

const ev = await fetch(
  `http://localhost:8080/v1/glad/fria/${friaId}/runtime-evidence?window_days=90`,
).then(r => r.json())

window_days defaults to 90.

Export¶

Two ways to get the document out. Prefer the async one for anything real.

# synchronous
curl -s "http://localhost:8080/v1/glad/fria/FRIA-3F9A…/export?fmt=json" -o fria.json

# async — survives a slow render
read JOB TOKEN < <(curl -s -X POST \
  "http://localhost:8080/v1/glad/fria/FRIA-3F9A…/export/async?fmt=pdf" \
  | jq -r '"\(.job_id) \(.token)"')

until [ "$(curl -s "http://localhost:8080/v1/glad/doc-jobs/$JOB/status?token=$TOKEN" | jq -r .status)" = "done" ]; do
  sleep 2
done
curl -s "http://localhost:8080/v1/glad/doc-jobs/$JOB/download?token=$TOKEN" -o fria.pdf

import time

job = c.post(f"/v1/glad/fria/{fria_id}/export/async", params={"fmt": "pdf"}).json()
while True:
    st = c.get(f"/v1/glad/doc-jobs/{job['job_id']}/status",
               params={"token": job["token"]}).json()
    if st["status"] == "error":
        raise RuntimeError(st.get("error", "render failed"))
    if st["status"] == "done":
        break
    time.sleep(2)

pdf = c.get(f"/v1/glad/doc-jobs/{job['job_id']}/download", params={"token": job["token"]})
open("fria.pdf", "wb").write(pdf.content)

const job = await fetch(
  `http://localhost:8080/v1/glad/fria/${friaId}/export/async?fmt=pdf`, { method: "POST" },
).then(r => r.json())

for (;;) {
  const st = await fetch(
    `http://localhost:8080/v1/glad/doc-jobs/${job.job_id}/status?token=${job.token}`,
  ).then(r => r.json())
  if (st.status === "error") throw new Error(st.error)
  if (st.status === "done") break
  await new Promise(r => setTimeout(r, 2000))
}

const blob = await fetch(
  `http://localhost:8080/v1/glad/doc-jobs/${job.job_id}/download?token=${job.token}`,
).then(r => r.blob())

The token is required on both follow-up calls. On failure, the job's error carries the real reason — read it rather than reporting a generic failure.

The generated PDF/DOCX contains the cover page and system identity, every Article 27 section, the risk and mitigation matrices, the approval block when approved, the runtime evidence, and the regulatory mapping appendix.

What Is a FRIA?¶

A FRIA is a structured document that assesses the impact of deploying an AI system on the fundamental rights of individuals affected by it. It must be completed before deployment of high-risk AI systems and kept current throughout the system's operational life.

The FRIA dossier in Geodesia G-1 covers:

• The AI system being deployed and its purpose
• Categories of individuals affected
• Fundamental rights that could be impacted
• Probability and severity of each impact
• Mitigating measures taken
• Residual risk assessment
• Human oversight procedures
• Responsible persons and sign-off

Status Values¶

A FRIA dossier moves through three states. Only an approved dossier satisfies the EU AI Act Article 27 pre-deployment requirement.

Dossier Section Reference¶

The dossier lives under record_json and follows the Article 27 structure. Each key is an object you can supply at creation, or patch later through PUT …/{fria_id} under record_json.

Every key is pre-filled from the deployment-context template at creation; supplying your own object merges over the defaults rather than replacing the section wholesale, so you can correct one field without re-authoring the rest.

EU AI Act Article Mapping¶