The EU’s AI Act utilizes a risk-based regulatory framework, yet a 2025 report from the EU Agency for Fundamental Rights (FRA) indicates this structure is failing to yield practical results. Following interviews with AI providers, government officials, and civil society experts in five member states, the agency discovered that those utilizing high-risk AI generally lack organized procedures for evaluating the full spectrum of rights violations their software might create.
High-Risk Applications Under Scrutiny
Under the Act, applications are tiered by danger, placing high-risk tools between banned “unacceptable risk” items and lightly regulated minimal-risk ones. Such high-risk technology is utilized in sensitive sectors including law enforcement, migration control, job screening, credit checks, and public assistance eligibility. While allowed, these systems must satisfy rigorous standards involving data governance, risk management, openness, human supervision, and post-launch monitoring.
The FRA points out that high-risk AI is frequently used in areas impacting vulnerable groups heavily, such as migrants, people with disabilities, and welfare recipients. Flaws in oversight or risk evaluation within these spheres could widen existing gaps, specifically if measures for equality and non-discrimination are not applied carefully.
Assessment Gaps and Institutional Challenges
Based on FRA interviews, no providers or deployers of potential high-risk AI performed assessments that fully integrated fundamental rights issues. Rather, evaluations focused mostly on data protection, technical metrics, or business and legal hazards, revealing the distance between the Act’s goals and current reality.
The FRA emphasizes that purely technical and compliance-based evaluations are insufficient to determine if a system honors rights. Achieving standards like precision, durability, or cyber safety does not guarantee respect for rights such as privacy or due process. A system might perform as intended while still generating discriminatory outcomes if situated inside prejudiced administrative procedures or deployed without sufficient safeguards.
Need for Stronger Safeguards and Guidance
The FRA characterizes fundamental rights impact assessments as instruments meant to supplement the Act’s wider risk management duties. These evaluations seek to spot potential rights damage before and during system launch. Nevertheless, the FRA warns that performing significant assessments requires adequate institutional strength, mixed expertise, and clear procedural instructions—conditions that might not be uniform across public bodies.
Without these resources, impact assessments could turn into empty formalities instead of useful harm-prevention tools. The FRA advises clearer standards for human supervision, higher participation from independent oversight bodies, and more rigorous post-deployment monitoring.
Delays and Broader Implications
In July 2026, the EU’s Digital Omnibus on Artificial Intelligence entered into force, formally delaying the application of the AI Act’s high-risk obligations by more than a year, to December 2027—a concession that the technical standards needed to support these requirements are not yet in place. If the gap between the Act’s aspirations and current practice was already visible in 2025, a further delay makes it wider.
The FRA’s analysis serves as a reminder that successful AI regulation depends on more than just legal frameworks; it requires the will and ability of institutions to monitor and fix rights-based harms. As global policymakers look to the EU AI Act as a blueprint for governance, these findings highlight the necessity of turning regulatory ambition into enforceable protections.