What is an AI impact assessment?
An AI impact assessment is a written analysis of who an AI system could affect and how, carried out before the system is put into use and revisited when it changes. It records the intended purpose, the people affected, the plausible failure modes, the measures taken against them, and the risk that remains after those measures. It is the document that turns a discussion about risk into something an auditor can sample.
What it contains
The intended purpose, stated narrowly. Most of the value comes from writing down what the system is not for, because that boundary is what later tells you a use has drifted.
Who is affected, including people who are not users. The person a decision is made about is often not the person operating the system.
Plausible failure modes, described concretely enough to test against. A system that could be wrong is not a failure mode. A system that ranks a candidate lower because of how their address parses is one.
The measures taken, and the residual risk that remains after them. An assessment that concludes with no residual risk has usually stopped early.
A named owner and a date. Both are what make it a control, not an essay.
How it differs from a DPIA
A data protection impact assessment asks about risk to personal data and to the rights of the people that data is about. An AI impact assessment asks a wider question that includes people whose personal data is not involved at all.
They overlap heavily and are often run as one exercise. Doing so is reasonable as long as the wider question gets asked, and the AI section does not become a paragraph appended to a privacy template.
Where personal data is in play, data protection obligations continue to apply in parallel. The EU AI Act states that it applies without prejudice to EU data protection law.
What each framework asks for
The NIST AI RMF distributes this across MAP and MEASURE: identify the risk in context, then characterize it with methods that are recorded.
ISO/IEC 42001 has an Annex A control area for AI system impact assessment, covering impact on individuals and on groups.
The EU AI Act sets a risk-management requirement for high-risk systems in Article 9. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force 27 July 2026, deferred both high-risk routes without removing the obligations: the Annex III category to 2 December 2027 and the Annex I product category to 2 August 2028. Which obligations apply to you depends on your role and on how the system classifies.
Common questions
- When should an AI impact assessment be done?
- Before the system is put into use, and again when its purpose, its data or its population changes materially. An assessment written after go-live records a decision instead of informing one, which is most of what the exercise is for.
- Who should write it?
- The system's named owner, with input from whoever understands the affected population. Handing it to a central risk function to write alone tends to produce an accurate document that the team operating the system has never read.
- How long should it be?
- Long enough to name the failure modes and short enough that the owner will revisit it. A template that runs to forty pages usually gets completed once and never opened again, which fails the standard it was written to meet.
Find out where you stand
The assessment on this site asks 24 questions against the framework you pick and returns a score, a verdict and, where a control is short, the one thing to fix first. It runs in your browser and takes about ten minutes.
It is a self-assessment, not an audit, not a certification, not a conformity assessment and not legal advice.
Run the assessment