Developing an Ontology for AI Act Fundamental Rights Impact Assessments

Harshvardhan J. Pandit; Tytti Rintamaki

REVIEW 5 major objections 5 minor 23 references

Developing an Ontology for AI Act Fundamental Rights Impact Assessments

T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes the first ontology for modelling the EU AI Act's Fundamental Rights Impact Assessment (FRIA) as a machine-readable, interoperable information process that supports automated compliance tooling.

desk verdict A clearly scoped first FRIA ontology that is stronger as a conceptual proposal than as a validated artifact; the four outcome statuses are interpretive and need legal backing or an implementation. read the letter →

arxiv 2501.10391 v1 pith:ZICULB2T submitted 2024-12-20 cs.CY cs.AI

Tytti Rintamaki , Harshvardhan J. Pandit This is my paper · ORCID

classification cs.CYcs.AI

keywords AIActFundamentalRightsImpactAssessmentFRIAOntologySemanticWebDataPrivacyVocabularyDPIARisk

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to make the Fundamental Rights Impact Assessment (FRIA) required by Article 27 of the EU AI Act machine-readable and interoperable. It argues that organisations currently conduct FRIAs using unstructured word-processor documents, which blocks automated tooling and cross-department consistency, even though the AI Act itself requires a questionnaire with an automated tool. The authors build an OWL ontology that represents the FRIA as a structured information process: its metadata, the necessity assessment, the Article 27-1 inputs (intended purpose, duration, frequency, affected persons, risks, oversight, instructions, mitigation), the four possible outcome statuses, notification to authorities, and the questionnaire/tool. The ontology extends the Data Privacy Vocabulary (DPV), reusing the approach developed for GDPR Data Protection Impact Assessments. If it is correct, it gives deployers a standards-based way to create, update, and share FRIA documentation and to power the automated compliance tools the AI Act calls for.

What carries the argument

The central object is the FRIA ontology, a formal vocabulary written in OWL/RDFS+SKOS that extends the Data Privacy Vocabulary (DPV). The paper treats the FRIA not as a single document but as an information process with six stages, and creates a concept for each: fria:FRIANecessityAssessment, fria:FRIAProcedure, fria:FRIAOutcome, fria:FRIANotificationAssessment, fria:FRIAQuestionnaire, and fria:FRIATool, each linked to the existing eu-aiact:FRIA concept via dpv:hasAssessment. The mapping between each Article 27 clause and a DPV concept (e.g., dpv:Risk, dpv:Duration, dpv:HumanInvolvementForOversight) is what turns the legal text into a queryable, reasoner-friendly structure.

What would settle it

If a real FRIA document produced by a deployer under Article 27 contained a required field that cannot be expressed in the ontology, or if the official questionnaire template published by the AI Office introduced an obligation the ontology cannot represent, the ontology's completeness claim would be refuted.

Watch

Extended reading notes

Core claim

The central claim is that the FRIA under AI Act Article 27 can be, and for the first time has been, formally represented as an ontology covering both the information involved and the procedure for conducting the FRIA itself. The ontology introduces six groups of concepts: metadata (who did it, when, versioning), the necessity assessment (whether a FRIA is required), the inputs specified in Article 27-1 (processes, intended purpose, duration, frequency, intended use, affected categories, risks of harm, human oversight, instructions for use, mitigation measures), the outcome statuses (unacceptable risk, high residual risk, risks acceptable, risks mitigated), the notification obligation under Article 27-3, and the questionnaire and automated tool under Article 27-5. Each AI Act clause is mapped to a DPV concept or a newly created extension, so the resulting ontology is interoperable with existing GDPR/DPIA modelling and can be used with SPARQL, SHACL, and OWL reasoning.

Load-bearing premise

The ontology's correctness rests on the authors' own legal reading of Article 27, specifically how each clause maps to an existing DPV concept and which four outcomes a FRIA can have, and that reading is not checked against legal expertise or real completed FRIAs.

Editorial extensions

If this is right

Deployers can generate and update FRIA documentation in a structured format that the AI Act's required automated tool can consume directly.
Compliance information becomes interoperable across organisational units and with existing GDPR DPIA records, since both are expressed in DPV.
Market surveillance authorities can receive and validate FRIA notifications in machine-readable form, enabling automated completeness checks.
The ontology supports SPARQL queries and SHACL validation, letting auditors verify that a FRIA covers all Article 27 requirements.
Future AI Act changes and national exemptions, such as the Article 46(1) notification exemption, can be added modularly without breaking the core model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If adopted, the four outcome statuses could feed a public or supervisory registry of high-risk AI deployments, but the paper does not address how statuses would be aggregated or compared across organisations.
The claim of being the first FRIA ontology rests on a single legal reading of Article 27; testing the clause-to-concept mapping against the AI Office's expected questionnaire template or against court/authority interpretations would show whether the mapping is stable.
One could implement both proposed options for modelling affected persons (redefining dpv:DataSubject versus introducing dpv:HumanSubject) and benchmark them against real organisational FRIA documents to see which better supports the Article 27-1c categories.
The ontology could be extended to cover the still-unpublished AI Office questionnaire once it appears, turning the present model into the core of a full compliance pipeline.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The paper is the first dedicated ontology for the AI Act's Fundamental Rights Impact Assessment that I know of, and it is a genuine contribution to the compliance-ontology space. The authors use LOT properly, publish their competency questions, and reuse DPV, AIRO, VAIR and TAIR rather than reinventing concepts. The resulting model covers the metadata, the procedure, inputs, outcomes, notification, and the Article 27(5) questionnaire and tool requirement. The clear separation between these procedural modules is the best part, and the discussion of how the FRIA relates to DPV's DPIA model is useful.

The transparency about interpretation is also a plus. The authors repeatedly say 'we interpret' when mapping Article 27 clauses to concepts. That honesty makes the paper easier to build on.

The soft spots are real but not fatal. The stress-test note is correct: the four FRIA outcome statuses (unacceptable risk, high residual risk, acceptable, mitigated) are the authors' invention, not a scheme in the AI Act. Article 27(1) lists information to be included; it does not define a classification with these four buckets. The paper even acknowledges that the simplest reading is boolean. Shipping an ontology with unvalidated outcome categories is a problem if the goal is compliance tooling, because it will force real assessments into a mould the law does not mandate. The same goes for the necessity assessment: the trigger for a FRIA is whether the system is high-risk under Article 6 and Annex III, not a separate assessment outcome. These are not fatal to the paper as a proposal, but they need either legal validation or an explicit 'one possible model' framing.

The bigger gap is the absence of any artifact. There is no OWL file, no SPARQL or SHACL tests against the competency questions, and no worked example. The central claim that the ontology enables automated tools is therefore unsubstantiated. For a workshop paper this is acceptable; for a journal claim it would not be.

The self-referential relationship with DPV is worth noting since the co-author maintains it, but the reuse itself is sensible and the integration plan is a feature, not a flaw.

Bottom line: this is a useful conceptual proposal for people building AI Act compliance tooling and for the DPV community. It deserves a serious referee, but a rigorous referee should push for either the serialized ontology with competency-question tests or a softer version of the claims.

Referee Report

5 major / 5 minor

Summary. The paper proposes an OWL ontology for representing Fundamental Rights Impact Assessments (FRIA) under Article 27 of the EU AI Act, built by extending the Data Privacy Vocabulary (DPV) and related AIRO/VAIR vocabularies. It follows the LOT methodology, presents a requirements specification with eight competency questions, and describes six conceptual groupings: metadata, necessity, inputs, outcomes, notifications, and automated tools. The conclusion claims this is the first ontology for FRIA under the AI Act.

Significance. If the ontology were fully specified and validated, it could provide a standard machine-readable representation to support FRIA documentation and automated compliance tools, an area of practical need. The paper's reuse of DPV and alignment with existing risk/impact vocabularies is a sensible design choice, and the competency questions capture relevant information needs. However, the contribution as presented is a sketch rather than a reusable ontology: no serialized artifact, no formal definitions, no evaluation against the stated competency questions, and no validation of the underlying legal interpretations.

major comments (5)

[Section 4 and Conclusion] The paper never provides an ontology implementation. The namespace is a placeholder ("https://example.com/FRIA#"), no class or property axioms are defined, and no RDF/OWL serialization is offered. Consequently, the claim in the Conclusion to be "the first ontology for modelling the FRIA" cannot be verified, and the ontology cannot be deployed in the automated tools the paper envisions. A machine-readable artifact is a minimal requirement for an ontology paper.
[Section 4.4] The four FRIA outcome statuses (unacceptable risk, high residual risk, risks acceptable, risks mitigated) are introduced without legal basis. Article 27(1) requires an assessment of impacts on fundamental rights but does not prescribe a four-category outcome classification. The paper itself notes "the simplest interpretation implies a boolean categorisation" and then offers four categories without citing legal authority. Because these statuses are central to the FRIAOutcome concept, a deployer whose real-world assessment yields a different conclusion (e.g., conditional continuation, redesign, no impact) would be forced into one of these four categories, which may misrepresent the legal obligation.
[Section 4.2] The "necessity assessment" (fria:FRIANecessityAssessment with statuses FRIARequired/FRIANotRequired) mischaracterizes the trigger for FRIA. The obligation to conduct a FRIA arises from the classification of an AI system as high-risk under Article 6 and Annex III, not from an internal assessment step within the FRIA itself. This invented procedural step should either be removed or reframed as documentation of the legal qualification, not as a distinct assessment with its own statuses.
[Table 1] The competency questions (CQ1-CQ8) are listed but never answered. The paper does not map each question to the corresponding classes/properties, nor does it show how the ontology would support queries (e.g., SPARQL) to retrieve the requested information. Without this traceability, the LOT methodology is only partially followed, and the claim that the ontology models the FRIA process is unsubstantiated.
[Sections 3.2 and 4.6] The paper proposes to add concepts to DPV but does not specify their formal position (e.g., subclasses, superclasses) or discuss consistency with existing DPV modules. Several concepts are named with inconsistent prefixes ("fria:" vs. "aiact:" vs. "eu-aiact:"), making it unclear which namespace the authors intend. This should be resolved in a revised artifact.

minor comments (5)

[Section 4.1] The phrase "to refere to a log of changes" contains a typo; it should be "refer."
[Sections 4.3 and 4.6] There are spelling errors: "assocaited" in Section 4.3 and "conecpt" in Section 4.6 should be "associated" and "concept" respectively.
[Section 4.6] The concepts "aiact:FRIATool" and "aiact:FRIACompletedQuestionnaire" use a prefix that is inconsistent with earlier sections, where the authors use "fria:" for FRIA-specific concepts; this should be harmonized for clarity.
[Section 4.3] The paragraph discussing PROV-O as an alternative modelling approach is brief and does not explain how it would relate to or replace the proposed ontology; it could be removed or developed further.
[Section 3.1] Given that AIRO is based on an early draft of the AI Act, the reuse of concepts such as AISubject should be checked against the final text of Article 27, including the terminology around "natural persons and groups of natural persons."

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the ontology is constructed from the external AI Act text and prior semantic-web resources; the main weaknesses are interpretive and validation gaps, not self-referential derivation.

full rationale

The paper's derivation chain runs from AI Act Article 27 to an OWL ontology. Each mapping is explicitly presented as an interpretation, for example 'we interpret' in Section 4.3 and 'in the simplest interpretation implies a boolean categorisation' in Section 4.4, so the chosen concepts are not forced by the Act. The four FRIA outcome statuses in Section 4.4 and the necessity assessment in Section 4.2 are author-added modelling constructs rather than explicit clauses of Article 27; this is a legal-validity and correctness risk, not circularity, because nothing in the paper derives those statuses by fitting them to a target dataset or by definitionally equating the conclusion with the premise. The reliance on DPV and on the authors' prior DPIA ontology [3] is substantial, and the second author is explicitly disclosed as DPV's maintainer, but these citations are used as reusable building blocks and state-of-the-art context, not as the evidence that makes the FRIA claim true; the central claim is benchmarked against external legal text and external prior art such as AIRO, VAIR, TAIR, Mantelero, and others. No equation, fitted parameter, or imported uniqueness theorem is invoked to make the result tautological. The absence of a serialized OWL artifact and the lack of external legal validation are completeness and soundness concerns, not circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The new ontology classes (e.g., fria:FRIANecessityAssessment, fria:FRIAOutcome) are the proposed contribution itself, not auxiliary entities invoked to explain an observation. Their grounding is the AI Act text and reuse of DPV concepts, so they are not listed as ungrounded invented entities. The free-parameter list is empty because the paper fits no numerical data and introduces no tunable constants.

assumptions (4)

domain assumption The DPV vocabulary provides a valid and sufficient foundation for modelling legal compliance processes.
Invoked in Section 3.2 and Section 4, where DPV is adopted as the base and is described as the only actively maintained survey ontology.
ad hoc to paper The authors' interpretation of AI Act Article 27(1) clauses, including the grouping of inputs and the four FRIA outcome statuses, is legally correct.
Section 4.3 and 4.4 map each clause to concepts; the paper explicitly says 'we interpret' at several points, so the legal reading is an unverified assumption.
domain assumption Article 27(5)'s 'automated tool' can be represented as an extension of dpv:Technology without additional semantics.
Section 4.6 states the tool is a Technology and does not define what automation means, despite the AI Act leaving the term ambiguous.
domain assumption The reuse of existing assessments (FRIA or DPIA) as inputs can be adequately captured by the dpv:hasData relation.
Section 4.3 recommends using dpv:hasData to indicate prior FRIA or DPIA inputs, assuming this relation captures the legal notion of 'relying on'.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Developing an Ontology for AI Act Fundamental Rights Impact Assessments." pith.science (2026). https://pith.science/paper/ZICULB2T

@misc{pith2026250110391,
  author       = {Pith},
  title        = {Pith review of: Developing an Ontology for AI Act Fundamental Rights Impact Assessments},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZICULB2T}},
  note         = {Machine review of arXiv:2501.10391}
}

read the original abstract

The recently published EU Artificial Intelligence Act (AI Act) is a landmark regulation that regulates the use of AI technologies. One of its novel requirements is the obligation to conduct a Fundamental Rights Impact Assessment (FRIA), where organisations in the role of deployers must assess the risks of their AI system regarding health, safety, and fundamental rights. Another novelty in the AI Act is the requirement to create a questionnaire and an automated tool to support organisations in their FRIA obligations. Such automated tools will require a machine-readable form of information involved within the FRIA process, and additionally also require machine-readable documentation to enable further compliance tools to be created. In this article, we present our novel representation of the FRIA as an ontology based on semantic web standards. Our work builds upon the existing state of the art, notably the Data Privacy Vocabulary (DPV), where similar works have been established to create tools for GDPR's Data Protection Impact Assessments (DPIA) and other obligations. Through our ontology, we enable the creation and management of FRIA, and the use of automated tool in its various steps.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 12 canonical work pages

[1]

Regulation 2024/1689 Of The European Parliament And Of The Council of 13 June 2024 laying down harmonised rules on Artificial Intelligence (Artificial Intelligence Act), 2024

2024
[2]

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Official Journal of the European Union L119 (2016)

2016
[3]

H. J. Pandit, A Semantic Specification for Data Protection Impact Assessments (DPIA), Towards a Knowledge-Aware AI (2022) 36–50. doi:10.3233/SSW220007

doi:10.3233/ssw220007 2022
[4]

Poveda-Villalón, A

M. Poveda-Villalón, A. Fernández-Izquierdo, M. Fernández-López, R. García-Castro, Lot: An industrial oriented ontology engineering framework, Engineering Applications of Artificial Intelligence 111 (2022) 104755

work page 2022
[5]

Golpayegani, H

D. Golpayegani, H. J. Pandit, D. Lewis, Airo: An ontology for representing ai risks based on the proposed eu ai act and iso risk management standards, in: Towards a Knowledge-Aware AI, IOS Press, 2022, pp. 51–65

work page 2022
[6]

Golpayegani, H

D. Golpayegani, H. J. Pandit, D. Lewis, To be high-risk, or not to be—semantic specifications and implications of the ai act’s high-risk ai applications and harmonised standards, in: Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency, 2023, pp. 905–915

work page 2023
[7]

Golpayegani, I

D. Golpayegani, I. Hupont, C. Panigutti, H. J. Pandit, S. Schade, D. O’Sullivan, D. Lewis, AI Cards: Towards an Applied Framework for Machine-Readable AI and Risk Documentation Inspired by the EU AI Act, in: Privacy Technologies and Policy, volume 14831, Springer Nature Switzerland, Cham, 2024, pp. 48–72. doi:10.1007/978-3-031-68024-3_3

doi:10.1007/978-3-031-68024-3_3 2024
[8]

Hernandez, D

J. Hernandez, D. Golpayegani, D. Lewis, An open knowledge graph-based approach for mapping concepts and requirements between the eu ai act and international standards, arXiv preprint arXiv:2408.11925 (2024)

arXiv 2024

Show all 23 references

[9]

Fundamental Rights Impact Assessment (FRIA) | aligner, https://aligner-h2020.eu/fundamental- rights-impact-assessment-fria/, 2021

2021
[10]

A. Mantelero, The Fundamental Rights Impact Assessment (FRIA) in the AI Act: Roots, legal obligations and key elements for a model template, Computer Law & Security Review 54 (2024) 106020. doi:10.1016/j.clsr.2024.106020

2024
[11]

Gerards, M

J. Gerards, M. T. Schaefer, A. Vankan, I. Muis, Fundamental Rights and Algorithms Impact Assess- ment, 2022

2022
[12]

Government of Canada, Algorithmic Impact Assessment tool, 2024

2024
[13]

Inverardi, S

N. Inverardi, S. Bertaina, I. Biganzoli, A. Cosentini, R. Desiante, D. Fontanella, I. G. Penco, Fun- damental Rights and AI Impact Assessment: A proposal for a new quantitative approach, in: 2024 International Joint Conference on Neural Networks (IJCNN), 2024, pp. 1–8. doi:10....

2024
[14]

Malgieri, C

G. Malgieri, C. Santos, Assessing the (Severity of) Impacts on Fundamental Rights, 2024. doi:10. 2139/ssrn.4875937. arXiv:4875937

2024
[15]

Janssen, M

H. Janssen, M. Seng Ah Lee, J. Singh, Practical fundamental rights impact assessments, International Journal of Law and Information Technology 30 (2022) 200–232. doi:10.1093/ijlit/eaac018

2022 doi
[16]

Esteves, V

B. Esteves, V. Rodríguez-Doncel, Analysis of ontologies and policy languages to represent infor- mation flows in gdpr, Semantic Web 15 (2024) 709–743

2024
[17]

Kurteva, T

A. Kurteva, T. R. Chhetri, H. J. Pandit, A. Fensel, Consent through the lens of semantics: State of the art survey and best practices, Semantic Web 15 (2024) 647–673

2024
[18]

N. A. Zaguir, G. H. Magalhães, M. M. Spinola, Challenges and enablers for gdpr compliance: systematic literature review and future research directions, IEEE Access (2024)

2024
[19]

Gharib, P

M. Gharib, P. Giorgini, J. Mylopoulos, An ontology for privacy requirements via a systematic literature review, Journal on Data Semantics 9 (2020) 123–149

2020
[20]

Gharib, P

M. Gharib, P. Giorgini, J. Mylopoulos, Copri v. 2—a core ontology for privacy requirements, Data & Knowledge Engineering 133 (2021) 101888

2021
[21]

Palmirani, M

M. Palmirani, M. Martoni, A. Rossi, C. Bartolini, L. Robaldo, Pronto: Privacy ontology for legal reasoning, in: Electronic Government and the Information Systems Perspective: 7th International Conference, EGOVIS 2018, Regensburg, Germany, September 3–5, 2018, Proceedings 7, Sp...

2018
[22]

H. J. Pandit, B. Esteves, G. P. Krog, P. Ryan, D. Golpayegani, J. Flake, Data Privacy Vocabulary (DPV) – Version 2, 2024. arXiv:2404.13426

2024 arXiv
[23]

T. Lebo, S. Sahoo, D. McGuinness, K. Belhajjame, J. Cheney, D. Corsar, D. Garijo, S. Soiland-Reyes, S. Zednik, J. Zhao, Prov-o: The prov ontology, W3C recommendation 30 (2013)

2013

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Regulation 2024/1689 Of The European Parliament And Of The Council of 13 June 2024 laying down harmonised rules on Artificial Intelligence (Artificial Intelligence Act), 2024

2024

[2] [2]

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Official Journal of the European Union L119 (2016)

2016

[3] [3]

H. J. Pandit, A Semantic Specification for Data Protection Impact Assessments (DPIA), Towards a Knowledge-Aware AI (2022) 36–50. doi:10.3233/SSW220007

doi:10.3233/ssw220007 2022

[4] [4]

Poveda-Villalón, A

M. Poveda-Villalón, A. Fernández-Izquierdo, M. Fernández-López, R. García-Castro, Lot: An industrial oriented ontology engineering framework, Engineering Applications of Artificial Intelligence 111 (2022) 104755

work page 2022

[5] [5]

Golpayegani, H

D. Golpayegani, H. J. Pandit, D. Lewis, Airo: An ontology for representing ai risks based on the proposed eu ai act and iso risk management standards, in: Towards a Knowledge-Aware AI, IOS Press, 2022, pp. 51–65

work page 2022

[6] [6]

Golpayegani, H

D. Golpayegani, H. J. Pandit, D. Lewis, To be high-risk, or not to be—semantic specifications and implications of the ai act’s high-risk ai applications and harmonised standards, in: Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency, 2023, pp. 905–915

work page 2023

[7] [7]

Golpayegani, I

D. Golpayegani, I. Hupont, C. Panigutti, H. J. Pandit, S. Schade, D. O’Sullivan, D. Lewis, AI Cards: Towards an Applied Framework for Machine-Readable AI and Risk Documentation Inspired by the EU AI Act, in: Privacy Technologies and Policy, volume 14831, Springer Nature Switzerland, Cham, 2024, pp. 48–72. doi:10.1007/978-3-031-68024-3_3

doi:10.1007/978-3-031-68024-3_3 2024

[8] [8]

Hernandez, D

J. Hernandez, D. Golpayegani, D. Lewis, An open knowledge graph-based approach for mapping concepts and requirements between the eu ai act and international standards, arXiv preprint arXiv:2408.11925 (2024)

arXiv 2024