The Fundamental Rights Impact Assessment (FRIA) under the EU AI Act is meant to protect fundamental rights from AI harms, but its practical rollout raises hard questions. This article unpacks FRIA’s core components and its relationship to the GDPR’s Data Protection Impact Assessment, showing how FRIA’s focus on “interferences” — rather than just quantifiable “damages” — gives it a far broader reach, including cases with no personal data at all. It then turns to the EU’s boldest move: an expansive jurisdictional claim built on “territorializing” extraterritorial obligations and the effects doctrine, positioning FRIA as a tool of internal due diligence with global human rights ambitions. The piece closes with a research agenda addressing sovereignty conflicts, AI’s black-box opacity, and the practical hurdles of enforcing rights-based standards worldwide.

The recording of the conference ‘My Chatbot, My Confidant? Protecting User Privacy in Generative AI Conversations’, held during the CPDP 2026 Conference, is available on YouTube!

Professor Theodore Christakis, Director of the AI Regulation Chair at the University Grenoble Alpes, joins the Masters of Privacy podcast to discuss the privacy of chatbot conversations, government and court access to AI-generated data, cybersecurity risks, and the rapid emergence of AI-powered health assistants in the context of the European Health Data Space.

The IAPP recently published an article by Prof. Theodore Christakis about the discourse among European policymakers in response to Anthropic’s decision to block foreign nationals’ access to two of its latest models.