One of the most overlooked aspects of the EU AI Act is not its classification of AI systems into prohibited, high-risk or limited-risk categories. Nor is it the much-discussed governance framework or conformity assessment process. Its most profound contribution lies elsewhere—in recognizing that Artificial Intelligence is capable of affecting not merely privacy, but the entire spectrum of fundamental human rights.
This recognition has led the European Union to introduce the concept of a Fundamental Rights Impact Assessment (FRIA).
For India, which is embarking on its own journey of AI governance while implementing the Digital Personal Data Protection Act, 2023 (DPDPA), this development deserves careful attention.
The Limitations of Data Protection
The DPDPA is a law governing the processing of digital personal data. It protects informational privacy and regulates the relationship between Data Fiduciaries, Data Processors and Data Principals.
However, AI systems have the potential to cause harms that extend well beyond data protection.
Consider a few examples.
-
- An AI-based recruitment tool may discriminate against women or older candidates without processing any sensitive personal data unlawfully.
- An AI-driven credit scoring system may deny financial opportunities to deserving individuals because of biased models.
- An AI-supported medical diagnosis may jeopardize patient safety.
- A predictive policing algorithm may affect liberty and equality.
- A generative AI system may influence freedom of speech, democratic discourse or access to information.
In each of these situations, privacy may not be the principal concern.
The affected rights could include equality, dignity, fairness, consumer protection, access to justice, education, employment and several other constitutional guarantees.
This is precisely why a conventional Data Protection Impact Assessment (DPIA) is no longer sufficient.
What is the Fundamental Rights Impact Assessment?
The EU AI Act requires deployers of specified high-risk AI systems to evaluate how the deployment of AI may affect the fundamental rights guaranteed under the Charter of Fundamental Rights of the European Union.
Unlike a DPIA, which concentrates on risks arising from processing personal data, the FRIA evaluates the possible impact on a broad set of rights such as:
-
- Human dignity
- Equality before law
- Non-discrimination
- Privacy
- Protection of personal data
- Freedom of expression
- Freedom of thought
- Rights of children
- Rights of persons with disabilities
- Consumer protection
- Workers’ rights
- Right to education
- Freedom to conduct business
- Access to justice
- Healthcare
- Effective legal remedies
The list extends to more than twenty fundamental rights that AI systems may directly or indirectly affect.
The philosophy behind the FRIA is simple:
Artificial Intelligence must be evaluated not merely for what it does with data, but for what it does to people.
This is perhaps one of the most important conceptual shifts in AI governance.
India’s Constitutional Foundation
India does not have an equivalent of the EU Charter.
However, the Indian Constitution already provides a rich framework of fundamental rights that can serve the same purpose.
Among the most relevant are:
-
- Article 14 – Equality before law
- Article 19 – Freedom of speech and expression
- Article 21 – Protection of life and personal liberty, including the Right to Privacy recognised in the Justice K.S. Puttaswamy judgment
- Constitutional guarantees against arbitrary State action
- Principles of natural justice
- Consumer rights recognised under statutory law
- Labour protections
- Rights of children
- Rights of persons with disabilities
The constitutional philosophy is already available.
What is presently missing is a structured methodology to evaluate whether an AI system threatens these rights.
India Needs an Indian Fundamental Rights Impact Assessment
As AI becomes embedded in banking, healthcare, education, insurance, public administration and law enforcement, organizations should not limit themselves to asking:
“Is this AI system compliant with DPDPA?”
They must also ask:
-
- Is the system fair?
- Does it discriminate?
- Does it reduce human autonomy?
- Does it affect dignity?
- Does it create barriers to justice?
- Does it unfairly deny opportunities?
- Does it threaten democratic values?
These questions belong outside the traditional DPIA.
They require a broader governance instrument.
India therefore needs an Indian Fundamental Rights Impact Assessment (IFRIA).
Integrating IFRIA with DGPSI-AI
The DGPSI-AI framework already adopts a governance-oriented approach instead of treating AI merely as a technological problem.
An expanded governance model could consist of four complementary assessments.
1. Data Protection Impact Assessment (DPIA) with a focus on :
-
- Compliance with DPDPA
- Personal data processing
- Privacy risks
- Consent and lawful processing
2. AI Risk Assessment (AIRA) with a focus on:
-
- Model reliability
- Bias
- Hallucinations
- Security
- Robustness
- Operational risks
3. Indian Fundamental Rights Impact Assessment (IFRIA) with a focus on :
-
- Equality
- Fairness
- Human dignity
- Constitutional rights
- Consumer interests
- Employee rights
- Public interest
4. Algorithmic Accountability Assessment with a focus on :
-
- Explainability
- Transparency
- Auditability
- Human oversight
- Traceability
- Governance effectiveness
Together, these four assessments would provide a comprehensive governance architecture that is significantly broader than current compliance approaches.
Moving Beyond Compliance
Many organizations still perceive AI governance as another compliance exercise. That could be a mistake. Good governance is not merely about avoiding penalties. It is about earning trust.
AI systems influence employment, healthcare, finance, justice and democratic participation. Consequently, governance must protect not only data but also the constitutional values upon which society is built.
The EU has acknowledged this reality through the Fundamental Rights Impact Assessment.
India has the opportunity to adapt the same philosophy within its own constitutional framework rather than merely copying foreign regulations.
The Road Ahead
The next generation of AI governance in India should move beyond the traditional focus on privacy. Privacy remains an essential right. But it is only one among many rights that intelligent systems may affect.
As India develops its own AI governance ecosystem, the objective should be to protect human rights, not merely personal data. The DGPSI-AI, implementation specification no 9 supporting the Governance principle of “Ethics” states,
“The Deployer of an AI shall take all such measures that are essential to ensure that the AI does not harm the society at large…”
Under this provision, an Indian Fundamental Rights Impact Assessment could be considered as part of the best practice.
A structured Indian Fundamental Rights Impact Assessment (IFRIA), integrated with DGPSI-AI and the proposed AI Governance Standard of India (AIGSI), would represent a significant step in that direction.
The future of AI governance will not be determined solely by the sophistication of algorithms.
It will ultimately be judged by how effectively those algorithms preserve human dignity, constitutional freedoms and the rights of every individual whose life they influence.
Comments are welcome.
Naavi
