IDPC organises FRIA Workshop

24 October 2025

The Office of the Information and Data Protection Commissioner (IDPC) successfully organised a full-day workshop focused on the requirement to conduct a Fundamental Rights Impact Assessment (FRIA) under Article 27 of the AI Act.

The workshop was held in close collaboration with Professor Alessandro Mantelero, an acclaimed Associate Professor of Private Law and Law & Technology at the Polytechnic University of Turin. During the event, Prof. Mantelero shared his extensive experience on the importance of carrying out a fundamental rights impact assessment – even in cases where it is not legally required – prior to deploying or implementing a high-risk AI system. He also provided participants with valuable insights into the background of the project, explaining how it came to fruition and the rationale for basing the FRIA model on matrices rather than numerical values.

The workshop further explored the complementarity between the GDPR and the AI Act, highlighting the synergies between the FRIA and the Data Protection Impact Assessment (DPIA). Participants examined how these two assessment processes can be aligned to streamline compliance efforts and strengthen the protection of individuals’ rights, particularly in high-risk AI applications involving personal data processing.

The event featured a keynote address delivered by Commissioner Ian Deguara, as well as a presentation on the interplay between the AI Act and the GDPR by Dr Penelope Micallef Vassallo, Legal and European Affairs Senior Officer at the IDPC.

A panel discussion was held and included Prof. Alexiei Dingli from the University of Malta, Alexander Hanff - Privacy Professional, Dr Roxanne Meilak Borg from the University of Malta, and Neil Micallef from the Malta Digital Innovation Authority (MDIA). The theme of the panel session was “Navigating the Risks and Challenges to Fundamental Rights in the era of AI” and was moderated by Commissioner Deguara.

During the second half of the day, participants were divided into groups and presented with a practical use-case on which they applied the methodology introduced during the morning session. Each group was tasked with identifying the fundamental rights potentially affected, and subsequently assessing the likelihood and severity of the risks to those rights. The groups then presented their findings, which were reviewed and discussed by Prof. Mantelero, providing valuable insights into the practical application of the FRIA model.

The discussions and feedback gathered throughout the workshop offered meaningful contributions to the IDPC’s ongoing efforts to promote the importance of risk assessments. They will also serve as a valuable resource in supporting organisations as they prepare to meet the evolving obligations set out under the AI Act, while ensuring the protection of individuals’ fundamental rights remains at the core of AI deployment.