A fundamental-rights impact assessment is a required review of how a proposed system or use case may affect people’s rights and freedoms before it is deployed. In the AI Act context, it forces the operator to examine privacy, discrimination, due process, freedom of movement, and other legal harms, not just technical performance or business value.
This matters in cyber security because high-risk systems often create security and abuse risks at the same time. For live biometric identification, an assessment can reveal weak controls around watchlists, logging, retention, access control, and human review. It also helps prevent “mission creep,” where a tool approved for rare cases quietly becomes routine surveillance infrastructure. In practice, the assessment should identify the purpose, scope, safeguards, residual risks, and who is accountable if the system is misused. It is not a box-ticking exercise: it is a governance control that limits how far a powerful system can be pushed in the real world.