AI Impact Assessment
A structured process for identifying, analyzing, evaluating, and documenting the effects an AI system may have on people, organizations, society, and the environment throughout its lifecycle.
Impact assessment supports accountable deployment, regulatory readiness, procurement decisions, and defensible governance. It helps decision-makers identify unacceptable uses or missing safeguards before an AI system reaches production.
Before introducing automated candidate screening, an organization assesses impacts on applicants and recruiters, tests for unequal outcomes, documents human-review and appeal mechanisms, and establishes post-deployment monitoring.
An AI impact assessment is not the same as an AI risk assessment, data protection impact assessment, or algorithmic impact assessment, although they may overlap. A one-time checklist is insufficient when the system, data, users, or operating context changes.
The assessment defines the system and its context, identifies affected stakeholders and possible beneficial or adverse impacts, evaluates severity and likelihood, assigns controls and responsibilities, and records residual impacts and monitoring requirements. It is broader than a technical risk assessment because it considers consequences for rights, safety, access, fairness, work, and other stakeholder outcomes.
Cybersecurity
ISO/IEC 42005:2025 — AI system impact assessment — https://www.iso.org/standard/42005; NIST — AI Risk Management Framework — https://www.nist.gov/itl/ai-risk-management-framework
