Scholars argue that the EU’s risk-based AI rules need strengthening to protect fundamental rights.
“I’m sorry, Dave, I’m afraid I can’t do that.”
HAL 9000’s iconic line from 2001: A Space Odyssey captures a familiar anxiety that artificial intelligence (AI), once embedded into decision-making systems, may operate beyond human control. As governments increasingly rely on AI to allocate resources, assess risk, and enforce laws, that general anxiety may be moving from science fiction into the realm of public policy.
The European Union’s AI Act—a comprehensive, binding framework for regulating AI—seeks to address these concerns through a risk-based regulatory model. A 2025 report by the EU Agency for Fundamental Rights (FRA) tested that model against reality, drawing on interviews with AI providers, public authorities, and civil society experts across five EU member states. It found that providers and deployers of high-risk AI systems generally lack structured processes for assessing the full range of fundamental rights risks their systems may pose—suggesting that the AI Act’s framework, however well-designed, may not yet be translating into practice.
At the core of the Act is a tiered system that categorizes AI applications by the level of risk they pose to individuals and society—where risk is defined to include threats to health, safety, and fundamental rights such as privacy, non-discrimination, and access to effective legal remedies. Systems deemed to present an “unacceptable risk,” such as certain forms of social scoring or real-time biometric identification in public spaces, are prohibited outright. At the other end of the spectrum, minimal-risk systems—such as AI-enabled recommendation tools—are largely exempt from new regulatory obligations.
Between these extremes lies the category of “high-risk” AI systems. These technologies are used in sensitive contexts, including law enforcement, migration management, employment screening, creditworthiness assessments, and access to public benefits. Although permitted under the AI Act, high-risk systems must comply with stringent requirements related to data governance, risk management, transparency, human oversight, and post-deployment monitoring.
The FRA notes that high-risk AI systems are often deployed in policy areas that disproportionately affect certain groups, including migrants, persons with disabilities, and recipients of social benefits. Because these populations already face structural vulnerabilities, shortcomings in risk assessment or oversight may intensify existing inequalities. The FRA cautions that, without careful attention to non-discrimination and equality, the use of AI in such contexts risks reinforcing patterns of exclusion.
According to the FRA’s interviews, none of the providers or deployers of potential high-risk AI systems conducted risk assessments that comprehensively incorporated fundamental rights concerns. Instead, assessments tended to emphasize data protection, technical metrics, or business and legal risk, underscoring the gap between the AI Act’s aspirations and present practice. This suggests a need for stronger operational guidance and rights-focused risk tools if the AI Act’s high-risk protections are to be meaningful in practice.
The FRA stresses that technical and compliance-based assessments alone cannot capture whether an AI system respects fundamental rights. Meeting technical standards—such as accuracy, robustness, or cybersecurity—does not necessarily ensure respect for rights such as equality, privacy, or due process. An AI system may operate as intended while still producing discriminatory or exclusionary outcomes if it is embedded within biased administrative practices or deployed without adequate safeguards.
The FRA describes the importance of fundamental rights impact assessments, which are intended to complement the AI Act’s broader risk management obligations. These assessments aim to identify potential rights-related harm before and during system deployment. But the FRA cautions that conducting meaningful assessments requires sufficient institutional capacity, interdisciplinary expertise, and clear procedural guidance—conditions that may not yet be consistently present across public authorities. The FRA warns that, without these supports, impact assessments risk becoming formalistic exercises rather than effective tools for harm prevention.
Importantly, the FRA does not reject the AI Act’s regulatory approach. Instead, it calls for stronger institutional support to supplement the framework’s legal foundations. The FRA recommends clearer standards for human oversight, greater involvement of independent oversight bodies, and more robust post-deployment monitoring. It also underscores that risks to fundamental rights can evolve over time, particularly as AI systems are updated, retrained, or repurposed, reinforcing the need for ongoing vigilance.
In July 2026, the EU’s Digital Omnibus on Artificial Intelligence entered into force, formally delaying the application of the AI Act’s high-risk obligations by more than a year, to December 2027—a concession that the technical standards needed to support these requirements are not yet in place. If the gap between the Act’s aspirations and current practice was already visible in 2025, a further delay makes it wider.
By focusing on fundamental rights, the FRA explores both the promise and the limitations of classifying AI systems by risk alone. As policymakers around the world look to the EU AI Act as a model for AI governance, the FRA’s analysis may serve as a reminder that effective regulation relies on the will and capacity of institutions to monitor and address rights-based harms.
