Acme Insurance buys Workday Talent Acquisition AI v2026.1 for its EU + US hiring program. Five thousand candidates pass through it each quarter: recruited into sales-development roles across Frankfurt, Madrid, Dublin, New York, and Austin. The General Counsel signed the procurement contract in March 2026. The Chief People Officer scheduled the go-live for September 1, 2026. The Chief AI Officer's job between March and September is to produce one artifact: a Fundamental Rights Impact Assessment under Article 27 of Regulation (EU) 2024/1689, covering the seven mandatory sections of Article 27(1)(a)-(f), with the Article 27(3) notification to the national market surveillance authority ready to file the moment go-live happens. The lesson that follows is the worked FRIA for that exact system: seven sections, each one drafted to the standard a regulator will read, with the multi-jurisdiction overlays (NYC LL 144, Texas TRAIGA, EEOC Title VII, GDPR Article 35) sequenced into the appendices. This is what a defensible Annex III §4 FRIA actually looks like when it lands on the desk.

Why This FRIA Matters - The §4 Hiring System as the Center of Gravity

Annex III §4 employment is the largest enterprise high-risk category in the EU AI Act. Workday, Eightfold, Beamery, HiredScore, Phenom, Paradox and the rest of the HR-tech market sell into the §4 sub-categories: "recruitment or selection of natural persons," "decisions affecting terms of work-related relationships," "allocation of tasks based on individual behavior or personal traits," and "monitoring and evaluation of performance and behavior." For most multinationals, the §4 program is the first FRIA they write, the loudest stakeholder battleground (HR, Legal, Privacy, Procurement, works council all have standing), and the most jurisdictionally entangled (EU AI Act + GDPR + NYC LL 144 + Texas TRAIGA + EEOC converge on the same artifact).

The §4 deployer in 2026 faces three concurrent pressures: Omnibus VII timing (stand-alone Annex III deployment moved to Dec 2, 2027 under the May 7, 2026 political agreement, though most enterprises build toward earlier soft go-lives); deployer-type analysis (a purely private §4 deployer is not automatically in Article 27(1) statutory FRIA scope: the statutory FRIA attaches for public bodies and private operators providing public services, and the universal §5(b)/§5(c) track does not apply to §4; large enterprises produce the artifact anyway because the cost differential to the generic risk assessment is small and the audit defense is large); and multi-jurisdiction harmonization (FRIA + NYC LL 144 bias audit + Texas TRAIGA intent review + EEOC Title VII analysis + GDPR Article 35 DPIA fire simultaneously, and the integrated artifact is the efficient response).

Acme, a fictional multinational EU+US insurer headquartered in Dublin with a 12-person Talent Acquisition team screening ~5,000 candidates per quarter for sales-development roles, is the modal Fortune-500 §4 deployment. Annex III §4 sub-category: "recruitment or selection of natural persons" plus arguably "decisions affecting terms of work-related relationships" (the system also feeds internal-promotion-eligibility scoring). Acme is private, not a public body, but voluntarily produces the full Article 27 FRIA because (i) it bids on public-sector group-insurance contracts that may shift the deployer-type analysis, (ii) the UK subsidiary will face equivalent UK requirements, and (iii) the audit committee has set a "FRIA as best practice for all Annex III deployments" policy.

Section 1 - Description of the Deployment Process and Intended Purpose (Article 27(1)(a))

Article 27(1)(a) requires "a description of the deployer's processes in which the high-risk AI system will be used in line with its intended purpose." A vague Section 1 makes every subsequent section vague; a precise Section 1 forces the rest of the FRIA into specificity.

System identification. Workday Talent Acquisition AI v2026.1 (vendor: Workday, Inc.; EU contracting entity: Workday Limited [Ireland]; deployment instance ID: ACME-WD-EU-2026-001). Acme configuration: "sales role family" model variant on Workday's pooled-customer dataset (Acme opted out of Acme-data inclusion in Workday's retraining), plus a custom "regulated-industry hiring" classifier fine-tuned on 14,500 Acme 2023-2025 historical hiring records. Trained by Workday Professional Services February 2026; reviewed against the Workday Acme Customer Bias Report (Feb 28, 2026).

Use case description. Three functions in sequence: (1) resume parsing, extracts structured candidate attributes from unstructured uploads; (2) candidate-to-role matching, produces a 0-100 match score against job-requisition criteria; (3) shortlist ranking, presents the top 30 candidates to the recruiter for human review. The system does not make automated rejection decisions: every candidate outside the top 30 is held in the requisition pool for manual review on request; every shortlisted candidate receives recruiter assessment before any candidate-facing communication. Intended purpose per the Workday Article 13 instructions for use (January 15, 2026): "to assist recruiters in identifying qualified candidates for high-volume sales-role recruiting from a candidate pool of 200-2,000 applicants per requisition, by producing a ranked shortlist of up to 30 candidates for human review."

Integration architecture. Candidates apply via the Acme careers portal (Workday Recruiting); applications are parsed by the Workday Talent Acquisition AI module within the EU-hosted Workday tenant (Dublin data center); shortlist scores write to the recruiter dashboard; recruiter decisions sync to the Acme HRIS for onboarding. The system does not communicate directly with candidates, all candidate-facing messages are recruiter-reviewed templated Workday Recruiting messages. No third-party ATS integration in scope.

Deployment scope. 5,000 candidate evaluations per quarter (20,000/year) across EU-27. US deployments (NYC, Austin) run under separate instances documented in Appendix A (NYC LL 144) and Appendix B (Texas TRAIGA); this FRIA covers EU only. EU geography: Dublin, Frankfurt, Madrid, Amsterdam, Warsaw, plus smaller-volume Milan, Stockholm, Copenhagen, Helsinki. Member State designation for Article 27(3) notification: Ireland (DPC pending AI Act market surveillance authority designation; see Section 7).

Intended-purpose boundaries, what the system is NOT used for. Explicitly excluded: (i) automated rejection (every rejection is a recruiter decision); (ii) compensation determination (Workday Compensation modules out of scope); (iii) promotion or termination of current Acme employees (separate Acme internal-mobility FRIA); (iv) candidate emotion, sentiment, or personality assessment (Article 5(1)(f) workplace emotion-recognition prohibition applies; Acme configuration explicitly disables Workday's optional video-interview sentiment analysis); (v) sourcing or database outreach (Acme uses LinkedIn Recruiter and Greenhouse under separate vendor agreements). Explicit "not used for" enumeration forecloses scope-creep arguments at later refresh cycles.

Section 2 - Period of Time and Frequency of Use (Article 27(1)(b))

Article 27(1)(b) requires "a description of the period of time within which, and the frequency with which, each high-risk AI system is intended to be used." Auditors use this section to assess whether the FRIA covers the actual operational footprint or a hypothetical one.

Period of use. Continuous from go-live (September 1, 2026) through the initial three-year Workday term (August 31, 2029) with two automatic one-year renewals unless 180-day non-renewal notice. Year-round operation; monthly maintenance windows (Sunday 02:00-06:00 UTC) queue applications with "ranking pending" status.

Frequency of use. Daily batch processing of all applications from the prior 24-hour cycle (batch start 06:00 UTC, target completion 08:00 UTC). Average ~55 candidates per business day across the EU footprint (5,000/quarter ÷ ~90 business days); peak ~300/day (typically Tuesday-Wednesday following weekend surges or campaign launches). Candidates are ranked against each requisition they have applied to; one candidate may appear in multiple requisitions.

Recruiter interaction frequency. Each of Acme's 12 EU recruiters reviews shortlists daily, ~90 minutes per day, ~6 minutes per candidate. Senior-recruiter escalation fires for ~8% of shortlisted candidates at the 0.65 confidence threshold.

FRIA refresh cadence. Quarterly bias-monitoring review (calendar-aligned) consumes the Workday customer-specific bias report. Annual full FRIA refresh on each September 1 anniversary covers all Article 27(1)(a)-(f) content. Triggered refresh within 30 days on: vendor model update with material scoring change; deployment scope expansion; fine-tune retraining; new data source; regulatory development (Member State implementing law, EU AI Office guidance, §4 court decisions); deployer-type-analysis change (e.g., Acme winning a public-sector contract triggering "private operator providing public services" scope).

Section 3 - Categories of Natural Persons and Groups Likely to Be Affected (Article 27(1)(c))

Article 27(1)(c) requires "the categories of natural persons and groups likely to be affected by [the system's] use in the specific context." Vague Section 3 leads to vague Section 4; specific Section 3 forces sharp Section 4.

Primary affected category: candidates. The 5,000-per-quarter EU candidate pool for Acme sales-development roles. Demographic composition per Acme's 2025 candidate-pool analytics (privacy-preserving aggregation under GDPR Article 89): ~45% male, ~45% female, ~10% non-binary or undisclosed; age ~60% 22-34, ~30% 35-49, ~10% 50+; race/ethnicity per voluntary self-identification under GDPR Article 9(2)(g) and AI Act Article 10(5) bias-monitoring lawful basis, broadly mirroring EU employment statistics by country with material city-level variation (Frankfurt and Madrid more diverse than Helsinki or Warsaw; Dublin between); ~6% self-identified disability; citizenship 78% EU, 14% EEA/Swiss, 8% third-country nationals with work permits.

Intersectional categories. Women 35-49 (post-parental-leave returners); disabled candidates with non-traditional trajectories; third-country nationals with foreign-credential profiles; candidates 50+ for entry-level roles. Single-axis monitoring misses intersectional disparate impacts.

Secondary category: recruiters. Acme's 12 EU recruiters as workers whose tasks are augmented (and potentially deskilled, monitored, or restructured) by AI-assisted ranking. Article 26(7) worker-representative notification completed: EU Works Council June 2026, plus German Betriebsrat, Dutch OR, Spanish comité de empresa (Appendix E).

Tertiary category: hiring managers. ~80 EU-based hiring managers across business units conduct interviews. The cascade, system ranks → recruiter shortlists → hiring manager interviews, means hiring manager decisions inherit any upstream bias.

Groups affected at scale. Applicant pools (shape shifts with learned historical patterns); demographic communities whose workforce representation aggregates over time; the broader EU sales-recruitment labor market.

Vulnerable categories warranting heightened scrutiny. Four categories per AI Office expected Article 27(1)(c) guidance: (i) refugee and migrant candidates with non-standard work-history documentation; (ii) candidates with disabilities subject to indirect disparate impact from neurotypical-baseline scoring; (iii) candidates 50+ facing entry-level age-discrimination patterns; (iv) women returning from parental leave with employment gaps. Targeted bias-monitoring per Section 4.

Section 4 - Specific Risks of Harm to Fundamental Rights (Article 27(1)(d))

Article 27(1)(d) requires "the specific risks of harm likely to have an impact on the categories of natural persons or groups of persons identified pursuant to point (c), taking into account the information given by the provider pursuant to Article 13." The discipline is to map Section 3 populations against the Charter of Fundamental Rights of the European Union article-by-article. Generic "AI poses risks" formulations fail; specific Charter-article harm analysis succeeds.

Charter Article 21 - Non-discrimination. The dominant risk. The Workday system is trained on historical hiring decisions which encode whatever bias patterns existed in historical decision-making. Sources of disparate impact in §4 hiring AI: (i) training-data bias, historical Acme decisions over-represent demographic patterns of the historical workforce; (ii) feature bias, features like "years of continuous employment" disadvantage parental-leave returners and disabled candidates with career gaps; (iii) proxy bias, features like university attended, postcode, or prior-employer industry may serve as proxies for race, gender, or socioeconomic status; (iv) scoring-threshold bias, the 0.65 confidence threshold may disparately impact populations clustered below; (v) shortlist-size constraint bias, the 30-candidate cap produces binary in/out outcomes from marginal score differences. Bias-monitoring metrics: four-fifths rule (selection rate for protected group ≥80% of majority group) on shortlist output (NYC LL 144 standard adopted as Acme group standard); demographic parity, equal opportunity, predictive parity per the fairness-metric-selection memo (lesson 017); intersectional disparity on the four vulnerable categories from Section 3; vendor-supplied Workday quarterly bias report. Specific harm vectors: qualified women, disabled candidates, candidates 50+, and third-country nationals with foreign credentials over-screened out.

Charter Article 8 - Protection of personal data. The system processes candidate personal data including special-category data (race/ethnicity, disability, health data implied from career-gap explanations) where voluntarily self-identified for bias monitoring under GDPR Article 9(2)(g) substantial public interest and AI Act Article 10(5) explicit bias-monitoring lawful basis. Specific risks: (i) special-category data over-collection, only the minimum necessary for bias monitoring retained; (ii) DSARs under GDPR Article 15 must include the AI-generated match score and ranking, candidate-facing DSAR pathway built for September 2026 go-live; (iii) GDPR Article 22 automated-decision-making safeguards, the system is not "solely automated" because recruiter review occurs before any candidate-facing decision; human-review-meaningfulness threshold documented (Section 5); (iv) cross-border data transfer, flows within Workday EU-hosted infrastructure; no Schrems-II-relevant US transfer except platform-engineering support under SCCs; (v) retention per Acme Records Retention Schedule (active candidates 3 years; rejected 1 year unless extended by national law); Acme opted out of Workday customer-pool retraining inclusion.

Charter Article 1 - Human dignity. Specific risks: (i) automated rejection without human review would violate dignity, system architecture prevents this; (ii) opaque rankings without meaningful explanation risk dignity harms, Article 50(1) AI-interaction disclosure and Article 86 right-to-explanation pathway built for every AI-ranked candidate; (iii) reduction of candidates to algorithmically-scored data points risks dehumanization, recruiter-review-meaningfulness safeguard and candidate-experience design (named communications; rejection messages explain the basis without algorithmic jargon) mitigate.

Charter Article 41 - Right to good administration. Extended to private deployers handling consequential decisions per the AI Office's expected guidance. Specific risks: right to processing within reasonable time (Acme commitment: shortlist decision within 14 days of application); right to a fair process (bias monitoring + recruiter review); right to know reasons (Article 86 right-to-explanation pathway + rejection-reason templates).

Charter Article 47 - Right to an effective remedy. Candidates have a right to effective remedy and fair trial if complaint-handling and redress are inadequate. Specific risks: opaque decision pathways foreclose remedy; inadequate complaint channels force candidates to supervisory authority or judicial proceedings; unremediated bias prolongs harm. Mitigation: Section 7 complaint channel, investigation process, remediation pathway, and coordination with the Irish DPC and other national supervisory authorities.

Quantitative risk scoring. Each risk scored on a likelihood × consequence matrix (1-5 × 1-5; 25-cell heat map). Charter Article 21: inherent 20/25 (likelihood 4 × consequence 5); residual 8/25 (likelihood 2 after bias monitoring + recruiter review; consequence 4 after remediation pathway). Article 8: inherent 12, residual 4. Article 1: inherent 12, residual 4. Article 41: inherent 8, residual 3. Article 47: inherent 8, residual 3. Reviewed quarterly per Section 2 cadence.

Section 5 - Human Oversight Measures (Article 27(1)(e) and Article 14)

Article 27(1)(e) requires "a description of the implementation of human-oversight measures, according to the instructions for use." This connects the FRIA directly to Article 14 (Human oversight). The discipline is to describe system-specific oversight measures (not generic "humans review the output" language), align with Article 14(4)(a)-(e) capabilities, and provide measurable effectiveness criteria.

Measure 1, recruiter review of every shortlist before any candidate-facing communication. No candidate-facing action (invitation, rejection, info request) issues without recruiter review of the system's match score and supporting features. The dashboard displays the score, top three contributing features (Workday SHAP-based attribution), the candidate's full application, and confidence-below-threshold flags. Recruiter records a decision in Workday Recruiting; the decision is the operative action, not the system's score.

Measure 2, confidence-below-threshold escalation to senior recruiter. Any candidate within 0.05 of the 0.65 decision threshold (scored 0.60-0.70) is auto-flagged for senior recruiter review with access to feature attribution and (where voluntarily self-identified) bias-monitoring sub-score for that cohort. Overrides logged for Acme's monthly override-pattern analysis.

Measure 3, weekly QA sampling. The TA Operations Manager samples 10% of shortlists weekly for: (i) recruiter-review meaningfulness (not rubber-stamping); (ii) override rate by recruiter (over-deference signal); (iii) demographic disparity in overrides (override patterns can themselves introduce bias). Findings feed the quarterly bias review.

Measure 4, quarterly bias-monitoring review by AI Governance Committee. Consumes the Workday vendor bias report, Acme's override-pattern analysis, four-fifths-rule selection-rate analysis per protected class, and intersectional disparity analysis on Section 3's four vulnerable populations. Attendees: Chief AI Officer, Chief People Officer, Chief Privacy Officer, Head of TA, Workday CSM, external bias-audit consultant.

Measure 5, annual independent bias audit. Third-party audit cross-referenced to the NYC LL 144 audit at Appendix A. Reviews bias metrics, override patterns, complaint outcomes (Section 7), and system-update history. Summary published per LL 144 disclosure; reviewed by Acme's audit committee.

Article 14(4) capabilities mapping. The FRIA explicitly maps the above measures to Article 14(4)(a)-(e): (a) understand capacities and limitations, recruiter training program (16 hours initial; 4 hours annual refresh); (b) avoid automation bias, QA sampling for over-deference patterns; recruiter rotation; (c) correctly interpret output, recruiter dashboard shows feature attribution; calibration exercises on confidence scores; (d) decide to disregard, override or reverse, unrestricted logged override capability for recruiter and senior recruiter; (e) intervene or interrupt via stop button, Chief AI Officer authority to suspend the system upon any serious incident or material review finding; suspension procedure in Acme's AI Incident Response Plan.

Effectiveness metrics. Recruiter override target 5-15% (low = over-deference; high = system disconnect); senior override target 20-40% of escalations; QA sampling 100% within 5 business days; quarterly review within 30 days of quarter end; annual independent audit on NYC LL 144 timeline.

Section 6 - Measures to Be Taken if Risks Materialize (Article 27(1)(f))

Article 27(1)(f) requires "the measures to be taken in the case of the materialization of those risks, including the arrangements for internal governance and complaint mechanisms." This is the runbook the deployer executes when the bias-monitoring alarm fires, a candidate complaint arrives, or a regulator opens an inquiry.

Bias-drift alert escalation. Quarterly drift compares current selection rates and disparate-impact ratios against the rolling four-quarter baseline. Tiers: (i) green, within 5% of baseline, no action; (ii) amber, 5-15% drift, AI Governance Committee notification within 5 business days, root-cause within 30 days; (iii) red, >15% drift or any four-fifths-rule failure (selection rate for protected group <80% of majority); immediate notification to Chief AI Officer, Chief People Officer, Chief Privacy Officer, General Counsel; remediation engaged within 24 hours; consider system suspension.

Remediation playbook. On red-tier alert or confirmed bias incident (complaint, regulator inquiry, audit finding), five sequenced steps: (1) contain, suspend or restrict to non-affected role families pending investigation; (2) investigate, root-cause across training data, features, threshold, override patterns, integration flows; (3) remediate, model retraining (via Workday Professional Services), threshold adjustment, feature deprecation, recruiter retraining, vendor escalation; (4) verify, re-run bias metrics on hold-out and next quarterly cycle; (5) document, full record in Acme's AI Incident Log with Article 73 classification.

Internal incident notification. AI Officer immediate; Legal immediate for regulator-touching incidents; Communications within 24 hours for reputational exposure; Internal Audit next meeting; Board AI Risk Committee quarterly (immediate for material). Routed through Acme's AI Incident Response Plan (Appendix F).

Article 73 serious-incident reporting decision tree. Article 73 places primary obligation on providers; Acme as deployer notifies Workday of any incident meeting the Article 73 definition (death, serious health/property/environment damage, serious irreversible disruption of critical infrastructure, or serious harm to fundamental rights). "Serious harm to fundamental rights" in §4 context plausibly includes confirmed systemic bias at material scale, candidate special-category data breach, or algorithmic exclusion of an identifiable protected group. Tree: (i) system vs. recruiter error? (ii) meets Article 73 definition? (iii) notify Workday within 24 hours; cooperate on the provider-side Article 73 report to the AI Office and Member State market surveillance authority (15 days standard; immediate for life-threatening). Acme retains parallel Article 26(5) deployer-side reporting.

Model-update trigger and vendor escalation. If root-cause is the Workday model (vs. Acme's fine-tune or config): immediate Workday Customer Success engagement; Professional Services investigation per MSA; remediation commitment with timeline; on failure, Acme's contractual right to suspend payment or terminate (MSA §8.4) plus procurement-contingency substitution.

Internal governance. AI Governance Committee chaired by Chief AI Officer; membership: Chief People Officer, Chief Privacy Officer, CISO, General Counsel, Head of TA, external bias-audit consultant. Monthly standing; ad hoc on incident. Quarterly briefing to Board Risk Committee; annual to full Board; ad hoc to Board AI Risk Committee for material incidents.

Section 7 - Complaint Handling, Redress, and Article 27(3) Notification

Article 27(1)(f)'s "arrangements for ... complaint mechanisms" combined with Article 27(3) notification warrants its own FRIA section: candidate-facing channel, investigation process, remediation pathway, Article 18 record-keeping, and coordination with national supervisory authorities.

Candidate complaint channel. Acme publishes a complaint pathway at https://acme.example.com/candidate-complaints (and equivalent Member State-language sub-pages) covering: what candidates can complain about (algorithmic ranking, recruiter decisions, data handling, candidate-experience); how to file (web form, email to [email protected], postal address); Acme's acknowledgment within 5 business days and substantive response within 30 calendar days; right to escalate to the Irish DPC and equivalent national DPAs and AI Act market surveillance authorities; right to effective judicial remedy under Charter Article 47. Cross-referenced in Acme's Article 50(1) candidate-facing disclosure.

Investigation process. The Acme Candidate Complaints Team (3 FTE within People Operations) triages each complaint within 5 business days into four categories: (i) information request, Article 86 right-to-explanation; response within 10 business days; (ii) process complaint, escalates to senior recruiter and Head of TA; 20 business days; (iii) bias complaint, escalates to AI Governance Committee for full investigation including cohort-level bias-monitoring sub-analysis; 30 business days; (iv) data complaint, routed to DPO under GDPR Articles 12-22. Every complaint receives substantive written response; template-only responses are unacceptable.

Remediation. Where investigation confirms a complaint: re-evaluation by senior recruiter without AI scoring (or re-run after model update); compensation for direct out-of-pocket costs (e.g., travel for invalidly cancelled interview); policy corrections (threshold adjustment, feature deprecation, recruiter retraining); GDPR Article 12-22 response plus erasure where requested; for confirmed systemic bias, Section 6 remediation playbook engages and the candidate is informed of corrective action.

Record-keeping per Article 18. Article 18 requires high-risk deployers to keep automatically-generated logs for a period appropriate to the system's intended purpose (six months minimum). Acme retains all AI system logs (match scores, feature attributions, recruiter decisions, override records, complaint records, investigations, remediations) for 10 years from the date of application or complaint disposition, whichever is later: supporting follow-on litigation, regulator audit, and the multi-year nature of employment-discrimination claims. Documented in the Records Retention Schedule.

National supervisory coordination. The Irish DPC is Acme's lead supervisory authority under GDPR Article 56(1) (Dublin main establishment) and may also serve as AI Act market surveillance authority pending designation. Cross-Member-State complaints flow through the GDPR one-stop-shop mechanism per GDPR Article 31; AI Act enforcement is expected to follow a similar pattern through the EU AI Office and European Artificial Intelligence Board.

Article 27(3) notification. Article 27(3) requires the deployer to notify the market surveillance authority of the FRIA results, submitting the filled-out template referred to in 27(5). Acme's plan: filing with the designated Irish authority (DPC pending formal designation; otherwise the Department of Enterprise, Trade and Employment which has signaled intent to coordinate); on or before September 1, 2026 go-live; using the Commission's template tool once issued under 27(5) or a Commission-aligned interim template; including the FRIA in substantive entirety plus Appendices A-F; refresh filing on substantial modification per Acme's quarterly cadence; notification register tracking each filing, receiving authority, date, and acknowledgment.

Appendices - Multi-Jurisdiction Cross-Reference

The Acme FRIA includes six appendices that prevent the same analysis from being written six times and provide audit-grade cross-reference:

• Appendix A - NYC Local Law 144 AEDT Bias Audit. The annual independent bias audit (NYC deployment) engaged through an external NYC-recognized auditor with results published per LL 144 disclosure obligations. Cross-walks the EU FRIA's Charter Article 21 analysis to the LL 144 four-fifths-rule and selection-rate-by-demographic-category reporting. Disparate-impact findings trigger the Section 6 remediation playbook.
• Appendix B - Texas TRAIGA Intent-Based Discrimination Review. TRAIGA HB 149 (effective Jan 1, 2026) requires intent-based discrimination analysis (disparate impact alone is insufficient). Documents that the Workday system is not designed or configured with discriminatory intent; bias-monitoring is designed to detect and remediate disparate outcomes; recruiter training emphasizes non-discrimination. Supports defense against AG enforcement under the $10K-$200K per-violation civil penalty framework.
• Appendix C - EEOC Title VII Analysis. Maps the FRIA bias-monitoring analysis to the EEOC Uniform Guidelines on Employee Selection Procedures (29 CFR §1607) four-fifths-rule; documents validation studies supporting job-relatedness; references recruiter training on Title VII obligations.
• Appendix D - GDPR Article 35 DPIA Cross-Reference. Cross-walks each Article 35(7)(a)-(d) DPIA item to the corresponding FRIA section: 27(1)(a) ↔ 35(7)(a) system description; 27(1)(b) ↔ 35(7)(a) processing operations; 27(1)(c) ↔ 35(7)(c) data-subjects and necessity-proportionality; 27(1)(d) ↔ 35(7)(c) risks; 27(1)(e) ↔ 35(7)(d) safeguards; 27(1)(f) ↔ 35(7)(d) measures to address risks. DPO sign-off recorded.
• Appendix E - Worker-Representative Consultation Records. Article 26(7) requires deployer-employers to inform workers' representatives and affected workers before putting the system into use. Documents consultation with the EU Works Council (June 2026), German Betriebsrat, Dutch OR, Spanish comité de empresa, and ad-hoc representative groups in other Member States. Minutes and acknowledgments attached.
• Appendix F - AI Incident Response Plan Cross-Reference. Points to specific runbook sections operationalizing the Section 6 remediation playbook, Article 73 reporting decision tree, and post-incident review process.

Cross-Walks, Refresh Cadence, and Six Common Mistakes

Cross-walks. The Acme FRIA cross-walks to: EU AI Act Article 27 (full); Article 27(3) notification; Article 10 + Article 10(5) (training data + special-category lawful basis); Article 13 (provider-supplied information for use); Article 14 (human oversight); Article 18 (record-keeping); Article 26 (deployer obligations including (5) serious-incident reporting and (7) worker-representative notification); Article 50(1) (AI-interaction disclosure); Article 73 (serious-incident reporting); Article 86 (right to explanation); Annex III §4; Charter of Fundamental Rights Articles 1, 8, 21, 41, 47; GDPR Article 35; ISO 42001 controls A.5 (impact assessment), A.6.1.1 (impact and risk considerations), A.7 (lifecycle), plus the AIMS spine; NIST AI RMF 1.0 Map 5 (impacts); NYC Local Law 144; Texas TRAIGA HB 149; EEOC Title VII / 29 CFR §1607 Uniform Guidelines; the fairness-metric-selection memo from lesson 017; the candidate-facing Article 50(1) disclosure from lesson 032; the FRIA scoping memo from lesson 044.

Refresh cadence. Quarterly bias-monitoring review (calendar-aligned); annual full FRIA refresh (each September 1 anniversary); triggered refresh within 30 days of: vendor model update; deployment scope change; fine-tune retraining; new data source; vendor M&A or contract change; regulatory development; Article 27(3)-relevant change in deployer-type analysis.

Retention. The FRIA artifact itself, plus the Appendices and the AI system logs, is retained for 10 years from the latest applicable date (FRIA filing, system retirement, last candidate-affected event, or complaint disposition) per Article 18 record-keeping floor (six months minimum) extended to 10 years for high-risk deployer-side records per Acme's group standard aligned to ISO 42001 A.7 lifecycle controls.

Mistake 1 - Skipping the Article 27(3) notification

The FRIA artifact is necessary but not sufficient, Article 27(3) requires notification to the market surveillance authority. Deployers that produce a FRIA but never file under 27(3) are in breach. Acme's notification register and the September 1, 2026 filing commitment prevent this.

Mistake 2 - Vague "specific risks" Section 4

Generic "the system may produce biased outcomes" fails. Enumerate Charter articles (1, 8, 21, 41, 47 minimum for §4 hiring); identify specific harm vectors per article (training-data, feature, proxy, threshold, shortlist-constraint bias for Article 21); score inherent and residual risk on a defined matrix; tie each risk to a Section 5 or 6 mitigation.

Mistake 3 - Generic Article 14 oversight language

"A human reviews the output" is not a Section 5 description. Describe system-specific measures (dashboard contents, confidence-below-threshold escalation, QA sampling cadence, quarterly review composition, annual independent audit) and map them explicitly to Article 14(4)(a)-(e) with measurable effectiveness criteria.

Mistake 4 - Missing complaint-handling and redress channel

Many enterprise FRIAs satisfy Article 27(1)(f) for internal governance but skip the candidate-facing complaint channel. Publish a candidate URL, name response timelines, classify complaint categories, document the remediation menu, and reference the candidate's right to escalate to the national supervisory authority.

Mistake 5 - Missing multi-jurisdiction appendices

A §4 hiring system across EU + NYC + Texas triggers FRIA + NYC LL 144 + Texas TRAIGA + EEOC Title VII + GDPR Article 35 simultaneously. Five separate artifacts fragment audit narrative and create inconsistency. The combined artifact with cross-reference appendices (Acme's A-F) is the answer: one artifact, six exhibits, full cross-walk.

Mistake 6 - Static FRIA without refresh

An AI system that satisfied Article 27 at go-live can drift out via vendor model updates, scope expansion, fine-tune retraining, new data source, vendor M&A, or regulatory development. Quarterly + triggered + annual refresh with documented records, operationalized in Acme's Section 2 cadence and AI Governance Committee quarterly schedule.

Key Takeaways

• Article 27 FRIA has seven operational sections. Six prescribed under 27(1)(a)-(f), deployment process and intended purpose; period and frequency; affected persons and groups; specific risks of harm; human-oversight measures; measures if risks materialize, plus the Article 27(3) notification to the market surveillance authority. Each section is its own drafting and audit-defense exercise.
• The §4 hiring system is the modal enterprise FRIA in 2026. Workday Talent Acquisition AI (and competing HR-tech systems) deployed by multinationals creates the largest FRIA workload. Bias-monitoring rigor, recruiter human-review meaningfulness, candidate complaint channel, and multi-jurisdiction appendices are the four practitioner pillars.
• Section 1 anchors specificity for the rest of the FRIA. System identification (vendor, version, deployment instance); use case (parsing, matching, ranking, recruiter shortlist); integration architecture; deployment scope; explicit "not used for" list. A vague Section 1 propagates vagueness through Sections 2-7.
• Section 3 demographic granularity is the audit-defense for Section 4. Primary, secondary, tertiary affected categories; intersectional categories (women 35-49 post-leave, disabled candidates with career gaps, third-country nationals with foreign credentials, candidates 50+ for entry roles); vulnerable categories per AI Office guidance.
• Section 4 must enumerate Charter articles, not generic risk language. Charter Article 21 non-discrimination (training data, feature, proxy, threshold, shortlist constraint bias vectors); Article 8 personal data (special-category data, DSAR, Article 22 automated decision-making, Schrems II, retention); Article 1 dignity (no automated rejection, transparency, candidate-experience); Article 41 good administration; Article 47 effective remedy.
• Section 5 maps system-specific measures to Article 14(4)(a)-(e) capabilities. Recruiter review of every shortlist; confidence-below-threshold escalation; weekly QA sampling; quarterly bias-monitoring review; annual independent audit. Effectiveness metrics: recruiter override rate (5-15% target), QA completion rate (100% within 5 days), review-cycle completion rate.
• Section 6 operationalizes incident response. Bias-drift alert escalation (green/amber/red); remediation playbook (contain, investigate, remediate, verify, document); Article 73 serious-incident reporting decision tree with deployer-vs-provider role analysis; vendor-escalation pathway.
• Section 7 complaint and redress requires a public-facing channel. Published URL, triage classification (information, process, bias, data), substantive written response, remediation menu, escalation right to national supervisory authority. Article 18 record retention 10 years for high-risk deployer logs.
• Multi-jurisdiction appendices avoid fragmentation. Appendix A NYC LL 144 bias audit; Appendix B Texas TRAIGA intent-based discrimination review; Appendix C EEOC Title VII analysis; Appendix D GDPR Article 35 DPIA cross-reference; Appendix E worker-representative consultation; Appendix F AI Incident Response Plan cross-reference. One artifact, six exhibits.
• Article 27(3) notification is not optional. The FRIA artifact alone is insufficient: Acme's notification register tracks the filing with the Member State market surveillance authority on or before go-live (September 1, 2026), with refresh notifications on substantial modification. The Commission's template tool under Article 27(5) is the expected delivery format.
• Refresh cadence: quarterly + triggered + annual. Quarterly bias-monitoring review; annual full FRIA refresh on go-live anniversary; triggered refresh within 30 days of vendor model update, scope change, fine-tune retraining, new data source, vendor M&A, regulatory development, or deployer-type-analysis change.
• Six common mistakes to inoculate against. Skipping Article 27(3) notification; vague specific-risks section; generic Article 14 oversight; missing complaint-handling redress; missing multi-jurisdiction appendices; static FRIA without refresh. The Acme FRIA's Sections 1-7 and Appendices A-F structure systematically prevents each.