2.1 Business entities as addressees of human rights

The concept of the horizontal effect of fundamental rights is commonly understood in the literature as the principle that these rights apply to conflicts arising between private individuals, rather than only between individuals and the state or other public entities. As noted by Frantziou (Reference Frantziou2019), this principle emphasizes the application of fundamental rights in private disputes.

At the current stage in the development of the human rights concept, undoubtedly business entities are addressees of human rights, in the meaning that they have the capacity to be subjects of these rights. There is also no doubt that these entities can violate these rights through their actions. In the legal doctrine, there is an ongoing debate as to how companies are held liable for not complying with human rights principles (Paust, Reference Paust2002), as in its present form the international system for the protection of human rights does not allow for the enforcement of liability on business entities. Therefore, it is vital to develop specific tools that will serve to impose the human rights observance on companies. The starting point for the design of such instruments is the distinction between different types of liability that a business entity may bear.

The emphasis on developing specific tools for imposing human rights observance on businesses highlights a crucial gap in the current legal framework, suggesting that without such mechanisms, the accountability of corporate entities for rights violations remains largely unaddressed.

2.2 Ethical responsibility

The first aspect for the discussion is responsibility of an ethical nature. In this paper, we will limit ourselves to analyzing business ethics norms that aim to regulate the operations of business entities (Gasparski, Reference Gasparski2007). It can be noted that business ethics norms protect values which are also safeguarded under human rights (Kietliński, Martinez Reyes & Oleksyn, Reference Kietliński, Martinez Reyes and Oleksyn2005). However, such a situation is not guaranteed in every case as understanding business ethics norms is not universal in nature (Gasparski, Reference Gasparski2007), and moreover, their observance is voluntary and frequently not subject to any institutionalized sanctions for their violations (Chryssides & Kaler, Reference Chryssides and Kaler1999; Filek, Reference Filek2004). Consequently, it cannot be stated that the system of regulation regarding human rights based on ethical norms will be sufficient for the protection of individuals harmed by corporate activities. Nevertheless, it remains necessary to develop ethical standards which will be helpful in regulating obligations not covered by legal provisions, and which will play a vital role in interpreting various legal norms.

This ethical dimension becomes particularly crucial in the current multipolar AI governance environment. Where different jurisdictions may prioritize different values – European emphasis on fundamental rights versus American emphasis on technological leadership and economic competitiveness – ethical frameworks provide space for corporate leadership that transcends minimum legal compliance.

The discussion highlights the inadequacy of voluntary business ethics norms in consistently protecting human rights, particularly in a complex global context where diverse legal and ethical priorities exist.

2.3 Corporate responsibility

The second area is the sphere of corporate responsibility. In the context of human rights, it has two meanings. The first one refers to a company’s voluntary decision to assume certain types of obligations, including those arising from legal norms which the company is not required to comply with. In this situation, it may face legal sanctions for actions that breach the internally imposed rules since such conduct violates the principles of fair competition.Footnote ²

In the second meaning, responsibility refers to the violation of the so-called social license to operate. This idea is based on the notion that a social agreement has created a specific area of human activity where business entities operate (Alston, Reference Alston2005; Jägers, Reference Jägers2002; Sullivan, Reference Sullivan2003). However, consequently, they are forced to act in accordance with rules related to natural persons to the broadest extent possible (Clapham & Jerbi, Reference Clapham and Jerbi2001; Jungk, Reference Jungk2001; Sullivan, Reference Sullivan2003). The source of corporate responsibility in this meaning also includes norms that have neither been imposed nor voluntarily adopted, but which according to societal expectations should be respected (Warhurst, Reference Warhurst2001). Such norms include the provisions on human rights. However, it must be emphasized that responsibility in this sense will never lead to legal sanctions. It resembles in nature the violation of ethical standards. Nevertheless, it should be stated that this understanding of “responsibility” has become the basis for the creation of normative documents. Among these the main role is played by the Guiding Principles on Business and Human Rights: Implementing the United Nations “Protect, Respect and Remedy” Framework, adopted on March 21, 2011, and developed by the Special Representative of the United Nations Secretary-General on business and human rights (BHR) (Ruggie, Reference Ruggie2011). The approach is based on three pillars which are intended to increase corporate accountability for human rights violations. These pillars are: the state duty to protect, access to remedy and the corporate responsibility to respect (United Nations, 2011). It is vital to underline that the unanimous adoption of the report by the Human Rights Council on June 16, 2011 was met with a highly positive response from the states, some of which announced plans to incorporate the relevant solutions into their own legal systems (Jerbi, Reference Jerbi2011). In addition, it is argued that the document implies a positive obligation on the part of the states to take such action (Krajewski, Reference Krajewski2018).

The focus on corporate responsibility often masks genuine accountability, allowing companies to evade real consequences for unethical practices.

2.4 Accountability for human rights violation

The third aspect of corporate responsibility for human rights violations is the aspect of accountability. This refers to the compliance with legal norms and in the event of their violation, the assumption of responsibility through proper procedures. As previously noted, there are currently no global instruments which would serve as a basis for such accountability (O’Brien, Reference O’Brien2019). However, there exist appropriate regulations at the national level and within the European Union. In this context, we will examine several of these regulations from the field of civil law. Due to the length limitations of this article, a comprehensive analysis is not possible. Our intention is to demonstrate that such regulations function in the legal frameworks of various countries and there are no obstacles to applying similar solutions to entities involved in AI development.

At the national level, one of the most important institutions shaping corporate responsibility is the Alien Tort Claims Act (ATCA), which forms part of the procedural rules before federal courts in the United States.Footnote ³ Under this regulation, district courts have jurisdiction over any civil action brought by any foreigner for a tort committed in violation of the general rules of international law or treaties to which the United States are a party (Jägers, Reference Jägers2002; Steinhardt, Reference Steinhardt and Alston2005; Stephens, Reference Stephens2002). This includes treaties concerning human rights (Farbstein, Reference Farbstein2023; Sosa v. Alvarez-Machain, 542 U.S. 692, 2004). It is significant due to the fact that in the first decade of the 21st century it served as a tool for seeking compensation for human rights violations (Kohl, Reference Kohl2014). Although in subsequent rulings the courts narrowed its application and held that it could not be applied extraterritorially (Kiobel v. Royal Dutch Petroleum Co., 569 U.S. 108, 2013), to companies other than American ones (Jesner v. Arab Bank PLC, 584 U.S. 241, 2018), and that it must concern “more domestic conduct than general corporate activity” (Nestlé USA, Inc. v. Doe, 2021); however, more recent decisions offer hope for a broader application of this legal institution (Farbstein, Reference Farbstein2023). The limitations of the ATCA highlight the challenges in achieving meaningful accountability for corporate human rights abuses.

2.5 European approach to private actors human rights responsibility

The development of law in continental European countries has led to the consolidation of civil liability of corporations for human rights violations as an expression of due diligence obligation, in particular in relations of subsidiaries and entities within the supply chain (Rouas, Reference Rouas2022). Examples of such solutions can be found in already mentioned French and German statutes. However, it is often noted that these provisions are of limited significance as commercial law tends to focus on the interests of shareholders and profit maximization (Sjåfjell, Reference Sjåfjell2020). Moreover, the obligations introduced are largely of formal and procedural character and are mostly concerned with identifying and managing risk to the enterprise rather than preventing or remedying human rights violations (Deva, Reference Deva2023).

The European Union has also taken steps to increase corporate accountability. Its flagship initiative in this area is Directive (EU) 2024/1760 of June 13, 2024 on CSDDD (Directive (EU) 2024/1760, 2024). This Act implements the principles of the UN Guiding Principles and establishes binding substantive and organizational duties related to the identification, prevention, mitigation and remedying actual and potential adverse impacts of a company’s operations, both within its own organization and in relation to subsidiaries and commercial relationships in the entire value chain. The Directive also provides for enforcement mechanisms in the form of supervision by national authorities, administrative sanctions and civil liability in tort in cases of willful breach of due diligence obligations. However, it should be noted that, although the Directive has been adopted, it may not enter into force in its current form, as it has become part of the Omnibus deregulation package (Directorate-General for Communication, 2025) proposed by the European Commission. The proposed amendments aim to narrow the scope of due diligence obligations to direct commercial relationships only, to remove the requirement to terminate contractual relationships with contractors committing gross violation of human rights and to limit the ability to pursue civil claims to domestic legal systems of Member States, without establishing harmonized EU conflict-of-law mechanisms (European Commission, 2025). These proposals have been met with protests from civil society organizations (ClientEarth, 2025), reflecting broader tensions between regulatory ambition and industry resistance that mirror global debates about the appropriate scope of corporate human rights obligations. It must be underlined that a similar trend can be observed in the field of legal provisions aiming at increasing accountability within the AI area. One example can be the AI Liability Directive (European Commission, 2022), which despite its flaws (Bieda et al., Reference Bieda, Flisak, Greser, Lubasz, Namysłowska, Skrodzka-Kwietniak and Załucki2024), served as complementary to the AI Act, including the area of liability for fundamental rights violations. The progress in corporate accountability often falls short, prioritizing shareholder interests over meaningful human rights protections.

2.6 US deregulation approach

However, these legal frameworks now operate within a changing global context where the United States has explicitly signaled its intention to counter what it perceives as “burdensome regulations” and multilateral governance approaches. The American AI Action Plan’s emphasis on reducing regulatory barriers and promoting American technological leadership creates new challenges for the extraterritorial application of European human rights frameworks and may encourage regulatory arbitrage by multinational corporations. Against this backdrop of evolving horizontal effect obligations, the European Union’s introduction of FRIA represents a concrete operationalization of these theoretical principles in the specific context of AI governance. This divergence underscores a critical tension in contemporary governance literature, where the balance between innovation and regulation becomes a battleground for differing ideological positions on the role of state oversight in digital environments.

3.1 FRIA as an evolution of risk assessment in European law

The European Union’s AI Act introduces the FRIA as the first comprehensive, legally mandated human rights evaluation mechanism specifically tailored for AI systems (Regulation (EU) 2024/1689, 2024). The entire AI Act is full of language that mandates the protection of fundamental rights. Recital 1 explicitly states that one of the objectives of the regulation is to “promote the widespread adoption of human-centric and trustworthy artificial intelligence (AI) while ensuring […] a high level of protection of […] fundamental rights as enshrined in the Charter of Fundamental Rights of the European Union.” The Act refers to the protection of fundamental rights throughout the entire AI lifecycle, including the development, deployment and use of AI systems. The provider of high-risk AI systems is primarily responsible for identifying and mitigating risks to fundamental rights by ensuring compliance through a risk management system (i.e. Articles 8, 9 and subsequent provisions of the AI Act). However, this regulatory framework is complemented by Article 27 of the AIA, which imposes specific obligations on deployers to safeguard fundamental rights during the operational phase, i.e., the part of the lifecycle over which the provider no longer has control. Recital 96, which refers directly to the FRIA, states that the impact assessment was introduced to effectively ensure the protection of fundamental rights in certain areas of social and economic life. The FRIA must be carried out by entities using high-risk AI systems that are either public sector bodies, private entities providing public services or operating in banking or insurance sectors.

The FRIA introduced in the AI Act is not an entirely novel invention by the EU legislator. It is not the first digital regulation in Europe to include similar provisions. Article 35 of the GDPR requires the conduct of a data protection impact assessment (DPIA) in specified circumstances. Similarly, Articles 34 and 35 of the Digital Services Act (DSA) impose risk assessment obligations on providers of very large online platforms and very large online search engines. The FRIA is not a product exclusive to the digital or AI domain. It builds upon substantial experience with HRIAs, which have been developed at the international level and implemented by companies in various sectors – some of which have already been discussed earlier. However, it is important to note that HRIA in the context of AI is not equivalent to traditional HRIA (Mantelero, Reference Mantelero2024). The AI Act establishes a comprehensive legal framework for protecting human rights specifically during the use phase of AI systems. Given the widespread application of AI across virtually every aspect of social and economic life, the relevance of this regulation extends across all sectors. Moreover, it imposes human rights obligations not only in the citizen–state relationship but also within horizontal relationships between individuals and private actors that may be both very large general purpose model AI providers, but also small and medium enterprises from AI value chain.

The introduction of the FRIA within the EU’s AI Act is a crucial step, but its effectiveness will ultimately depend on rigorous enforcement and the genuine commitment of all stakeholders to prioritize human rights over technological advancement.

3.2 Innovative aspects of FRIA

Because the regulation primarily governs social and economic interactions, it explicitly addresses the risks of fundamental rights violations by providers of high-risk AI systems. For this reason, Article 27 of the AI Act and its accompanying provisions should be considered innovative, as they establish an unprecedented convergence between traditional data protection approaches and evolving human rights obligations in the digital sphere.

The novelty of the AI Act and the FRIA lies also in the fact that it is the first regulation to establish a binding legal obligation to protect fundamental rights backed by enforceable sanctions in the event of interference. Until now, regulations concerning HRIA and systems for the protection of human rights in digital contexts have been voluntary (Bertaina, Ceravolo & De Gregorio, Reference Bertaina, Ceravolo and De Gregorio2025). In contrast, under the AI Act, the FRIA constitutes a mandatory assessment, and its outcomes must be used to prevent or mitigate risks (Mantelero, Reference Mantelero2024). The original proposal of the European Parliament envisioned the FRIA as applying to all high-risk AI systems under Article 6(2), with the sole exception of systems used for the management and operation of critical infrastructure. The final text retains this exception but also significantly narrows the overall scope of the FRIA. It now applies only to (1) deployers that are “public sector bodies” or “private entities providing public services” and (2) deployers of AI systems used for creditworthiness assessments of natural persons, credit scoring, and the evaluation of risk and pricing in life and health insurance. While this narrower scope is less ambitious from a fundamental rights perspective than the original proposal, it nonetheless represents a regulatory innovation.

The FRIA distinguishes itself from traditional HRIA mechanisms by introducing an ex ante approach to the protection of fundamental rights. This not only prevents harmful applications from entering the market but also turns the FRIA into a design tool, in line with the by-design approach (Mantelero, Reference Mantelero2024). This risk assessment accompanies AI systems throughout the entire deployment lifecycle. It is applied during the initial phases of planning and scoping, risk assessment and mitigation (including the identification of harm, evaluation of its impact and risk treatment) and post-assessment monitoring (Fulop & Poindl, Reference Fulop, Poindl, Pehlivan, Forgo and Valcke2025). What truly sets the FRIA apart from similar processes is this preventive, anticipatory character. The reference in Article 27(1) to the potential impact of AI system use and the criterion of likelihood underscores this forward-looking dimension. The aim of Article 27 revealed during legislative debates, and its systemic interpretation, lead to the conclusion that the FRIA is a forecasting exercise in risk evaluation and management. Risk materializes not when harm occurs, but when the deployer designs a specific use case for the AI system, thereby triggering the obligation to take appropriate mitigating measures (Mantelero, Reference Mantelero2024).

Importantly, the innovative aspect of the FRIA is also its recognition of the contextual and socio-technical nature of AI systems. The FRIA acknowledges the complex, distributed architecture of AI value chains, moving beyond traditional, linear regulatory models. Unlike conventional approaches that concentrate on single actors or one-dimensional processes, the FRIA requires deployers to assess fundamental rights implications across interconnected relationships within the AI ecosystem. This recognition of AI’s systemic character positions the FRIA as a bridge between individual rights protection and collective governance challenges (Mantelero, Reference Mantelero2024).

Ultimately, the FRIA offers a practical framework for fundamental rights protection, helping to bridge the gap between general AI ethics principles and concrete legal obligations (Bertaina et al., Reference Bertaina, Ceravolo and De Gregorio2025; Janssen, Galetta & Gellert, Reference Janssen, Galetta and Gellert2022). It is also connected with the broader Conformity Assessment process, contributing to a comprehensive risk management system for safeguarding fundamental rights (Fulop & Poindl, Reference Fulop, Poindl, Pehlivan, Forgo and Valcke2025).

One particularly important point is that, unlike previous sector-specific instruments such as the GDPR or the DSA, the FRIA is aimed at the broad protection of fundamental rights. While earlier frameworks addressed data protection through mechanisms like DPIAs or sectoral human rights concerns (such as those covered under DSA or ESG), the FRIA constitutes the first comprehensive effort to systematically integrate human rights evaluation into AI deployment processes and further, as AI is embedded in each sphere of business life, in almost each corporate workflow.

The FRIA, while a significant advancement in the regulatory landscape, risks falling short of its ambitious goals due to its narrowed scope and reliance on a compliance-driven approach that may overlook the nuanced realities of AI’s socio-technical impacts.

These innovative aspects of FRIA have largely survived recent deregulation pressures, though not without modifications. The November 2025 Digital Omnibus on AI draft extends FRIA implementation timelines from August 2026 to December 2027 for high-risk systems, while eliminating AI literacy obligations for employers. However, unlike the substantial weakening of CSDDD under Omnibus I, FRIA’s core human rights assessment requirements remain unchanged, suggesting that the EU considers AI governance more strategically essential than supply chain due diligence.

3.3 Comparative study of FRIA and DPIA

It is widely accepted that the FRIA evolved from the DPIA as a more comprehensive instrument for assessing the impact of AI on fundamental rights. The DPIA was introduced in Article 35 of the GDPR as a mandatory evaluation for data processing operations likely to pose a high risk to the rights and freedoms of natural persons. Although Article 35 refers broadly to a “likely high risk to the rights and freedoms of individuals,” the Article 29 Data Protection Working Party clarified that, while data protection frameworks adopt a risk-based approach, the phrase “rights and freedoms” primarily concerns the rights to data protection and privacy. However, it may also implicate other fundamental rights such as freedom of expression, freedom of thought, freedom of movement, freedom from discrimination, freedom of religion and conscience, and the right to liberty (Article 29 Data Protection Working Party, 2017; see also Barta, Kawecki & Litwiński, Reference Barta, Kawecki and Litwiński2021).

The DPIA involves a systematic assessment of the necessity and proportionality of data processing operations in relation to their purposes, an evaluation of risks to the rights and freedoms of data subjects and the adoption of measures to mitigate those risks. It is an ex ante risk management tool, which must be carried out prior to the start of processing, and it has a cyclical structure – must be updated when processing operations or their context change (Fulop & Poindl, Reference Fulop, Poindl, Pehlivan, Forgo and Valcke2025; Janssen et al., Reference Janssen, Galetta and Gellert2022). As noted above, despite the relatively broad formulation in Article 35, both legal theory and enforcement practice have interpreted the DPIA as being primarily focused on data protection. In contrast, the FRIA extends to all potentially affected fundamental rights and freedoms, as enshrined in the Charter of Fundamental Rights of the EU, while retaining the core methodological features of the DPIA: (1) an ex ante approach, (2) a rights-based risk assessment, (3) a cyclical, iterative structure throughout the lifecycle of the AI product or service and (4) a reliance on expert judgment (Malgieri & Santos, Reference Malgieri and Santos2025). The key difference lies in its broader scope – the FRIA is not limited to data protection but instead considers all potentially affected rights and freedoms (Janssen et al., Reference Janssen, Galetta and Gellert2022; Mantelero, Reference Mantelero2024).

The FRIA was introduced into the AI Act by the European Parliament, as part of a compromise in response to the European Commission’s proposal, which emphasized a human-centric approach and the protection of fundamental rights, but failed to fully embed these principles in its risk-based model. During the legislative process, arguments were raised against the inclusion of the FRIA, claiming that it was redundant in the presence of the DPIA and Article 35 of the GDPR. However, the adoption of Article 27 AI Act reveals important shortcomings in the practical implementation of the DPIA, particularly its limited attention to rights beyond data protection, which are often underdeveloped or overlooked in practice (Mantelero, Reference Mantelero2024). In the context of the DPIA, the assessment of various fundamental rights is often filtered through the lens of data protection. This leads to a situation in which data protection categories are used to justify the final decision, thereby overshadowing the rationale for evaluating the impact on other fundamental rights. In contrast, the FRIA, like the HRIA, requires a detailed consideration of each relevant fundamental right, based on their definitions in legal doctrine and case law. This results in more accurate and transparent outcomes in the assessment process (Mantelero, Reference Mantelero2024).

The transition from DPIA to FRIA signifies a crucial shift in evaluating AI’s impact, highlighting a need for a more inclusive approach that transcends data protection to holistically address the spectrum of fundamental rights at risk.

3.4 Scope of Article 27 of AI Act

In defining the scope of application of Article 27 of the AI Act, reference must be made to Recital 48. It states that when classifying an AI system as high-risk, a key consideration is the extent to which the system may adversely impact fundamental rights protected under the Charter of Fundamental Rights of the European Union. These rights include the right to human dignity, respect for private and family life, protection of personal data, freedom of expression and information, freedom of assembly and association, and the right to non-discrimination. Also covered are the right to education, consumer protection, workers’ rights, rights of persons with disabilities, gender equality, intellectual property rights, the right to an effective remedy and to a fair trial, the right of defense and the presumption of innocence, and the right to good administration. The recital further highlights the specific rights of children, as outlined in Article 24 of the Charter and the UN Convention on the Rights of the Child. The fundamental right to a high level of environmental protection, enshrined in the Charter and implemented through EU policy strategies, must also be considered in evaluating the severity of harm an AI system may cause, including potential threats to health and safety. The AI Act places particular emphasis on the rights of vulnerable persons. Recital 67 specifically refers to the protection of individuals belonging to especially sensitive groups, including those defined by racial or ethnic origin. Legal scholarship also points to certain rights that are particularly exposed to interference in the context of AI, such as privacy, equality, freedom of expression, and procedural and socio-economic rights (Janssen et al., Reference Janssen, Galetta and Gellert2022). However, it is crucial to note that all fundamental rights may be impacted by AI systems and are therefore subject to protection within the FRIA framework.

As a result, the FRIA significantly broadens the scope of human rights protection. We perceive FRIA as precedent-setting, as it is the first comprehensive framework mandating HRIA specifically for AI systems. FRIA establishes methodological and institutional foundations that influence global AI governance approaches. The regulation’s emphasis on systematic assessment, stakeholder engagement and ongoing monitoring creates a template for addressing the fundamental rights implications of AI deployment across different jurisdictional contexts. In doing so, it has the potential to catalyze similar regulatory developments at the international level. While the emphasis on rigorous human rights assessments in AI governance is commendable, the challenge lies in balancing thorough oversight with the need for agile regulatory frameworks that can adapt to technological advancements without hindering progress.

4.1 Shift in human rights protection mechanisms

As mentioned already in Section 2, fundamental rights enshrined in international treaties originally safeguard fundamental rights against the state and do not directly address private entities. And the EU recognizes that private companies can severely impact an individual’s fundamental rights. They have traditionally been assumed to act on equal footing with other private (natural and legal) persons. The law was interfering where imbalances occurred, protecting the less powerful party (consumer, employee) in sectoral regulations. However in recent years, the EU recognized that the equal footing of individuals and (large) private organizations approach is inappropriate. Especially in a technology context, this is often due to the systemic power and information asymmetries inherent to the current data processing practices of digital organizations, not only large corporations but also small and medium enterprises. The asymmetries commonly stem from an unequal distribution between those organizations and individuals, in terms of access to the data, controlling and comprehending the (often) opaque processing of that data, risk assessment, inequalities of wealth, capital, access to expertise, knowledge, power and so forth. This makes it difficult for even knowledgeable individuals to properly evaluate and come to informed decisions over whether they should do business with those organizations (Janssen et al., Reference Janssen, Galetta and Gellert2022).

The AI Act is one of the regulatory instruments designed to counteract this problem, and the FRIA, established within it, functions as a risk management tool specifically tailored for the private technology sector. Its core objective is to internalize the costs associated with fundamental rights violations. Private technology companies should bear the responsibility for identifying and mitigating fundamental rights risks already at the design stage of AI systems. Unlike public entities, which operate within democratically established procedures and are subject to constitutional oversight, private actors require external regulatory mechanisms that compel them to take fundamental rights into account. The FRIA forces companies to factor in the societal costs of their innovations, a principle known in economic theory as the internalization of externalities. This mechanism is particularly important in the context of the informational asymmetry between technology developers and the broader public. As mentioned above, private entities, driven by profit maximization, may consciously disregard negative social consequences unless they are legally required to address them (Ceravolo, Malgieri & Mantelero, Reference Ceravolo, Malgieri and Mantelero2025; Janssen et al., Reference Janssen, Galetta and Gellert2022; Mantelero, Reference Mantelero2024). The implementation of the FRIA represents a significant step toward holding private technology companies accountable for fundamental rights risks, it also raises questions about the effectiveness of external regulation in truly altering profit-driven behavior unless accompanied by a broader cultural shift within these organizations toward prioritizing ethical responsibility.

4.2 Theory versus implementation of FRIA

The AI Act clearly specifies which private organizations are obligated to uphold fundamental rights. At the same time, however, the scope and clarity of these obligations remain limited. Whereas Article 35 of the GDPR lays out relatively clear duties concerning data protection and the decision-making processes within that domain, the FRIA, by addressing the entire spectrum of fundamental rights, may prove far more challenging for private entities to implement. To clarify this ambiguity, the literature points to several arguments:

• – Private actors should be held to the same standard as public entities. To argue otherwise would contradict Article 1 of the AI Act and its underlying objectives – namely, the prevention of harm caused by high-risk AI systems.

• – A deployer preparing a FRIA must respect fundamental rights, interpret their limitations and apply the principle of proportionality where relevant. Yet, there are no established rules guiding how a private actor should conduct such a balancing exercise, especially when its own rights and economic interests may also be at stake. Consequently, it has been suggested in the literature that if the benefit of using an AI system outweighs its interference with fundamental rights, the deployer is acting lawfully. However, the greater the impact of the system on fundamental rights, the stronger the justification must be on the part of the private actor. This interpretation aligns with the European Court of Human Rights’ and Court of Justice of the European Union approach to balancing interests under GDPR (Fulop & Poindl, Reference Fulop, Poindl, Pehlivan, Forgo and Valcke2025, CJEU Case C-252/21, Case C-511/18, C-512/18 and C-520/18; ECHR Roman Zakharov v. Russia, 2015).

• – Infringement of the essence of a fundamental right is impermissible, whereas interferences may affect only non-core elements. That means that the deployer must be able to identify and assess what constitutes the core of a given right.

• – A deployer should prevent and mitigate all interferences with fundamental rights, seeking alternative or less intrusive means when such alternatives are adequate to achieve the intended goals.

These principles mirror the deliberations of constitutional theorists regarding the application of the principle of proportionality by public authorities. This suggests that private actors subject to the FRIA obligation will be required to assess the consequences of the systems they introduce on fundamental rights, respect those rights, explore their limitations and mitigate associated risks. FRIA will therefore raise awareness among private actors in the domain of fundamental rights and create legitimacy for decision-making in areas that affect public interests through technological choices. Whereas public authorities derive their legitimacy from a democratic mandate, private entities operate within the sphere of private autonomy, often less transparently and without parliamentary, judicial or public oversight. Thus, their legitimacy must be constructed through compliance with fundamental rights, and the FRIA framework with its requirements for consultation and participatory procedures supports this endeavor (Mantelero, Reference Mantelero2024; Malgieri & Santos, Reference Malgieri and Santos2025).

However the operationalization of FRIA requirements presents significant implementation challenges. They span technical, organizational and legal dimensions. Organizational capacity represents perhaps the most immediate implementation challenge. Few organizations possess the interdisciplinary expertise necessary for comprehensive fundamental rights assessment. Effective FRIA implementation requires competencies spanning human rights law, AI system analysis, stakeholder engagement and impact evaluation methodologies. This competency gap is particularly pronounced in smaller organizations or those without prior experience in human rights due diligence. It requires significant capacity building investments which may be too great burden and potentially may undermine the universal application of horizontal effect principles.

The assessment methodology challenge is compounded by the absence of standardized frameworks for evaluating AI system impacts on fundamental rights. FRIA operates in a relatively underdeveloped methodological landscape (Wernick, Reference Wernick2024). In the theory of law there are some frameworks presented (Bertaina et al., Reference Bertaina, Ceravolo and De Gregorio2025; Ceravolo et al., Reference Ceravolo, Malgieri and Mantelero2025; Mantelero, Reference Mantelero2024; Wernick, Reference Wernick2024). But so far methodological uncertainty creates implementation risks and may lead to inconsistent assessment quality across different organizations and sectors, potentially undermining the standardization objectives of horizontal effect implementation.

Stakeholder identification and engagement present additional complexity, as AI systems often affect diverse and sometimes difficult-to-identify communities. The distributed nature of AI impacts means that affected stakeholders may include not only direct system users but also individuals subject to algorithmic decisions, communities experiencing indirect effects and broader societal groups affected by systemic changes. Meaningful stakeholder engagement requires sophisticated outreach strategies, culturally appropriate consultation methods and mechanisms for incorporating diverse perspectives into assessment processes, reflecting the participatory dimensions of horizontal effect obligations.

Technical assessment challenges arise from the opacity and complexity of many AI systems, particularly machine learning applications that operate through patterns not easily interpretable by human assessors. FRIA implementation must address questions of algorithmic transparency, bias detection and impact attribution in contexts where system operations may not be fully understood even by their developers. This technical complexity is further complicated by the need to assess not only current system performance but also potential future impacts as systems adapt and evolve through learning processes, requiring dynamic assessment approaches that can accommodate algorithmic uncertainty.

Resource allocation and cost considerations present practical implementation barriers, particularly for smaller organizations or those deploying multiple AI systems subject to FRIA requirements. The comprehensive nature of fundamental rights assessment requires significant time investments, specialized expertise and ongoing monitoring capabilities. These resource requirements may create competitive disadvantages for organizations with limited compliance capabilities while potentially favoring larger entities with established risk management infrastructures, raising questions about the equitable application of horizontal effect obligations across different organizational contexts.

The disparity between the theoretical framework of the FRIA, which emphasizes a holistic assessment of fundamental rights, and its practical implementation reveals a significant gap in addressing rights outside of data protection, highlighting the need for a more robust integration of these principles in real-world applications.

4.3 Approaches divergence between the US and the EU regulations on AI and human rights governance

In our opinion, FRIA’s introduction coincides with growing international recognition of the need for human rights-centered AI governance. The timing of its implementation reflects lessons learned from the limitations of purely technical or market-based approaches to AI governance, incorporating insights from BHR frameworks that have evolved over the past decade. The regulation’s emphasis on impact assessment methodology draws from established human rights due diligence practices while adapting these approaches to the unique characteristics of AI systems, including their opacity, scalability and potential for automated decision-making that may bypass traditional accountability mechanisms. However, FRIA’s significance must now be understood within the context of emerging global tensions in AI governance. While the EU pursues comprehensive rights-based regulation, the United States has articulated a fundamentally different approach through its “America’s AI Action Plan,” confirmed by the Genesis Mission project, which explicitly prioritize innovation, competitive advantage and resistance to what it characterizes as “onerous regulation.” Furthermore, the US President’s Executive Order issued in December 2025 states that “it is the policy of the United States to sustain and enhance the United States’ global AI dominance through a minimally burdensome national policy framework for AI.” The Order further provides that

This policy direction suggests that regulatory frameworks imposing human rights-based obligations on corporations developing or deploying AI systems may be increasingly framed as unlawful or as creating an excessive regulatory burden. As a result, requirements aimed at embedding human rights protections, such as mandatory impact assessments or oversight obligations, risk being challenged not only politically but also through coordinated legal strategies designed to limit their enforceability.

This divergence creates new challenges for FRIA’s global influence and raises questions about the universal applicability of European AI governance models. FRIA’s implementation highlights a growing divide in AI governance strategies, where the EU’s rights-focused approach contrasts sharply with the US emphasis on innovation and deregulation, posing challenges for global harmonization in ethical AI practices.

5.1 Mandatory character of FRIA

Although FRIA evolved from HRIA (Wernick, Reference Wernick2024), it differs significantly from traditional risk assessment mechanisms. HRIA, as part of corporate due diligence, has primarily been used as an ex post reaction to critical events. FRIA under the AI Act constitutes a mandatory obligation that must be fulfilled before deploying an innovative solution in the real world. Another key distinction lies in its operational scope. Traditional HRIA functions mainly as a policy-oriented tool, providing companies with an assessment of potential impacts and a list of possible preventive or mitigating measures, while ultimately leaving the decision about which actions to implement to the discretion of the company. By contrast, under the AI Act, the FRIA is a binding assessment, and its outcomes must be acted upon to prevent or mitigate risk. Finally, FRIA in AI differs from traditional HRIA in the nature of the situations assessed. While HRIA is usually applied in the context of industrial activities located in a specific territory and impacting on a wide range of human rights, including social rights, AI products are often globally distributed solutions that usually impact on a range of fundamental rights (Mantelero, Reference Mantelero2024).

The mandatory nature of the FRIA fosters both awareness and legitimacy for engaging in HRIA within AI contexts. As organizations develop their capabilities and expertise through the implementation of FRIA, these competencies lay the groundwork for more comprehensive, voluntary human rights assessment frameworks, which may extend beyond regulatory requirements. This dynamic of gradual transition positions FRIA not only as a regulatory endpoint but also as a stepping stone toward the broader integration of human rights considerations into AI governance. It reflects the evolutionary potential of implementing the horizontal effect of fundamental rights in increasingly complex technological environments. The concept of FRIA marks a shift from reactive human rights assessments to a proactive, mandatory approach that integrates human rights considerations directly into the development and deployment of AI technologies, thereby enhancing accountability and a more responsible innovation landscape.

5.2 Importance of voluntary frameworks

This is where voluntary frameworks like the Council of Europe’s Human Rights, Democracy, and Rule of Law Impact Assessment (HUDERIA) become particularly significant (Council of Europe, 2024; Wernick, Reference Wernick2024). HUDERIA represents a comprehensive voluntary framework developed by the Council of Europe’s Ad Hoc Committee on AI (CAHAI) that provides structured, algorithm-neutral approaches to assessing AI system impacts throughout their lifecycle.

Unlike mandatory frameworks such as FRIA, HUDERIA’s voluntary nature allows organizations to extend human rights considerations beyond regulatory requirements, creating opportunities for ethical leadership and norm development where legal frameworks may be absent or insufficient. This flexibility becomes particularly valuable in a multipolar governance environment where organizations may seek to maintain consistent ethical standards across jurisdictions with different regulatory approaches. It can be used by both public and private actors for identifying and addressing risks and impacts to human rights, democracy and the rule of law.

The HUDERIA Methodology offers the combination of general and specific guidance and flexibility by allowing room for adaptation in the practical implementation. At the general level, it describes high-level concepts, processes and elements guiding risk and impact assessment activities of AI systems that could have impacts on human rights, democracy and the rule of law. It is a multi-step governance process offering an anticipatory approach to the governance of AI design. The methodology consists of four interconnected phases: Context-Based Risk Analysis (COBRA), Stakeholder Engagement Process (SEP), Risk and Impact Assessment (RIA) and Mitigation Planning (MP). Each phase is supported by comprehensive documentation through the Project Summary Report, ensuring accountability and continuous assessment capabilities (Janssen et al., Reference Janssen, Galetta and Gellert2022) (Council of Europe, 2024)

It includes three key steps:

1. 1. It identifies key risk factors – specific characteristics within an AI system’s lifecycle context – that heighten the likelihood of adverse impacts on human rights, democracy and the rule of law. These risk factors are grouped into three categories: the system’s application context, design and development context, and deployment context.

2. 2. Analyzing these factors enables and facilitates the checking of potential adverse impacts on human rights, democracy and the rule of law.

3. 3. Building on this information, the triage process focuses on identifying and prioritizing systems with significant risks, ensuring that the HUDERIA Methodology remains proportional and not overly burdensome for minimal or low-risk AI systems. This process also supports informed decision-making on whether the benefits of building or deploying an AI system outweigh its risks, particularly regarding potential impacts on human rights, democracy and the rule of law.

The SEP enhances the RIA by incorporating the perspectives of potentially affected individuals identified during the COBRA stage. Tailored to the identified risk factors and potential impacts, stakeholder engagement can take various forms and levels of participation. This process not only improves the quality of risk analysis but also fosters transparency, builds trust and enhances the usability and performance of the AI system.

The RIA provides a detailed evaluation of the potential and actual impacts of AI system activities on human rights, democracy and the rule of law, focusing particularly on systems posing significant risks identified during the COBRA triage. It involves re-examining, contextualizing and expanding upon potential harms, while assessing key risk variables such as scale, scope, reversibility and likelihood to prioritize and manage risks effectively. Building on the COBRA analysis and potential SEP insights, this step ensures a comprehensive understanding of the risks to inform mitigation and governance strategies.

The MP element of the HUDERIA process outlines actions and strategies to address adverse impacts and mitigate identified harms. It involves formulating targeted measures based on the severity and likelihood of these harms and developing a comprehensive plan to implement them. Where appropriate, it also includes establishing mechanisms for affected individuals and other stakeholders to access remedies.

HUDERIA prompts regular reassessments through the iterative revisitation phase, to ensure that AI systems continue to operate safely and ethically as the context and technology evolve and public is protected from emerging risks throughout the system’s life cycle. It is supposed to prevent and mitigate risks in the application of AI in corporate governance by ensuring that AI tools are used ethically, responsibly, and in compliance with governance principles. They include ethical and legal concerns over handling sensitive company and stakeholder data; the risks to inherit or amplify existing biases; complexity in allotment of responsibility for decisions made or suggested by AI; overreliance on technology and inability by AI to replace human judgment in governance decisions. The HUDERIA framework highlights the crucial role of proactive engagement and flexible governance in addressing potential risks of AI systems, emphasizing the need for organizations to move beyond mere compliance and actively foster ethical practices that uphold human rights and democratic principles.

5.3 Relationship between different impact assessment mechanisms

The relationship between FRIA and HUDERIA demonstrates how mandatory and voluntary frameworks can work together to create more comprehensive human rights protection than either approach could achieve independently. FRIA provides regulatory baseline requirements with enforcement mechanisms, while HUDERIA offers methodologies for organizations seeking to implement comprehensive rights assessment as a matter of ethical commitment rather than legal compliance. This complementarity is particularly significant because it addresses a crucial gap in traditional approaches to corporate responsibility: the space between what law requires and what ethics demands. FRIA ensures minimum compliance with fundamental rights obligations for high-risk AI systems within EU jurisdiction, while HUDERIA, which is conceptually aligned with FRIA, provides methodologies for organizations seeking to implement comprehensive rights assessment across their entire AI portfolio, regardless of regulatory requirements or in multijurisdictional dimension. Companies with global operations could find it efficient to apply FRIA-style assessment approaches across their international AI portfolios, even in jurisdictions without similar regulatory requirements. This harmonization effect could contribute to the global influence of EU regulatory approaches and create momentum toward international convergence around HRIA in AI governance. In our opinion, HRIA frameworks and tools like HUDERIA can promote rights protection particularly in contexts where legal regulations are absent, through voluntarily adopted principles that guide organizational behavior and create accountability mechanisms beyond regulatory requirements. The interplay between FRIA’s regulatory mandates and HUDERIA’s ethical frameworks highlights the potential for a more nuanced approach to corporate accountability in AI, bridging the divide between legal compliance and moral responsibility, especially in regions lacking robust regulations.