HUDERIA vs EU AI Act Article 27 FRIA

No, and HUDERIA does not claim you have. The methodology describes itself as non-legally binding guidance that does not have legal effect and is "not a means for implementing the Framework Convention" — it makes no claim to discharge any EU obligation either. Article 27 requires six specific items, a trigger at first use, and a notification to the market surveillance authority on the AI Office template; a HUDERIA produces a different set of artefacts on a different schedule for a different audience. The practical relationship runs the other way: a completed HUDERIA gives you most of the raw material for items (c), (d) and (f) — affected categories, specific risks of harm, and mitigation with access to remedies — but you still have to write the Article 27 assessment and file it.

Quite possibly, and this is the case most research institutions miss. Annex III point 3(a) covers AI systems intended to determine access or admission, or to assign people to educational and vocational training institutions at all levels; point 3(b) covers evaluating learning outcomes; 3(c) assessing the appropriate level of education a person will receive; and 3(d) monitoring and detecting prohibited behaviour of students during tests. Article 27 reaches deployers that are bodies governed by public law or private entities providing public services, with only Annex III point 2 carved out — so a public university deploying any of those systems is a covered deployer, not merely a covered provider’s customer. Whether a particular institution is a "body governed by public law" is a question of national law and legal form, not of whether it receives public funding, so that determination belongs with institutional counsel.

No. The European Union deposited its instrument of ratification of the Framework Convention on 15 May 2026, and CASRAI has been unable to fetch the Council of Europe Treaty Office chart directly to confirm the date the Convention takes effect in respect of the EU, so no entry-into-force date for the EU is stated here. What is clear from the HUDERIA text itself is that ratification would not make it binding in any event: Parties "have the flexibility to use or adapt the guidance, in whole or in part, to develop new approaches to risk assessment or to use or adapt existing approaches in keeping with their applicable laws", provided they meet their Convention obligations including the Chapter V baseline. HUDERIA is one available way to meet that baseline, not the required way.

Partly, and only for the Article 27 side. Article 27(4) provides that where a deployer has already carried out a data protection impact assessment under Article 35 GDPR or Article 27 of Directive (EU) 2016/680, the fundamental rights impact assessment complements it rather than repeating it. That is a genuine efficiency, but it is narrower than it sounds: a DPIA asks about processing of personal data and risks to data subjects, while Article 27 asks about the deployer’s processes, period and frequency of use, human oversight implementation, and internal governance and complaint mechanisms — none of which a DPIA necessarily covers. HUDERIA gives no such credit and asks for none, since it imposes no duty to discharge.

Start with the HUDERIA-shaped work, because of what it asks and when. Its COBRA triage and "zero questions" are designed to run while the build decision is still open — whether existing technologies already in place "are better placed" to solve the problem, whether impacts will be equitable across affected groups, whether available data is sufficient, and what marginal risk introducing AI adds to the current context. Article 27 cannot ask those questions, because it starts from a deployment that is going ahead and must be completed before first use. Running the open-ended assessment early and the compliance assessment late uses each instrument for what it can actually do, and the stakeholder engagement process produces exactly the evidence about affected groups that Article 27(1)(c) and (d) then need.

It sits beside them and neither has endorsed it. NIKOLAI is CASRAI’s own independent frontier-AI-safety dictionary, and the element that bears on this comparison is Likelihood Term on the N4 "Claims and argument" track, which proposes a controlled ladder of ordinal likelihood terms with a required likelihood.scheme reference naming which scale a source is using. The gap it describes is visible in exactly this pairing: HUDERIA names probability as a risk variable and notes it "may sometimes be referred to as likelihood", while Article 27 asks for specific risks of harm and prescribes no probability vocabulary at all — so two assessments of the same system can grade the same risk in terms that do not compare. Every crosswalk row on that element is a shadow mapping: CASRAI’s own reading of a published document, which no institution named on it has declared, endorsed or been consulted on. That changes only when an organisation files a Mapping Declaration.

Yes, in two places that sit with different offices. The first is deployment: a European university or research institute that is a body governed by public law and deploys an Annex III high-risk system — admissions and placement, evaluation of learning outcomes, exam proctoring under point 3, or an essential-services eligibility system under point 5(a) — is a covered deployer under Article 27 in its own right, which makes this a research-computing and institutional-counsel question rather than a vendor question. The second is procurement: because Article 27(1)(e) requires a description of how human oversight measures will be implemented "according to the instructions for use", the assessment depends on documentation the provider supplies, so the time to secure it is in the contract, not after go-live. HUDERIA has no compliance role for institutions on either point, but its stakeholder engagement process maps unusually well onto the consultation practices research ethics and IRB offices already run.