AI Impact Assessment

Most risk assessments ask how an AI system could harm the organization that uses it. An AI impact assessment asks a broader question: how could it affect the people on the receiving end and society more widely? A model that screens job applicants, sets insurance prices, flags benefit fraud or recommends medical treatment can change people's lives. An impact assessment looks at who could be affected, how, how seriously and what can be done to prevent or reduce harm. It brings in perspectives that technical and business teams might otherwise miss, such as those of affected communities and people with limited power to challenge decisions. The aim is to see the system from the outside, not just from the inside.

Impact assessments are becoming standard practice and, in some cases, legal requirements. Canada's federal government has required an Algorithmic Impact Assessment for many automated decision systems since 2019. The EU AI Act requires certain deployers of high-risk AI, including public bodies and organizations using AI for credit scoring or life and health insurance pricing, to carry out a fundamental rights impact assessment. ISO 42001 requires AI system impact assessments, and ISO/IEC 42005 gives guidance on conducting them. For risk, legal, product and policy teams, impact assessments help make AI decisions fairer and more defensible.

Definition of AI Impact Assessment

An AI impact assessment is a process for identifying, analyzing and documenting the potential positive and negative consequences of an AI system for individuals, groups, organizations and society, including effects on fundamental rights, and for determining measures to prevent or mitigate adverse impacts throughout the system's lifecycle.

It complements the AI risk assessment, puts AI ethics into practice and is required for certain high-risk uses under the EU AI Act.

What an AI Impact Assessment Covers

Purpose and context describe what the system does, where and how it will be used and the decisions it influences. The same system can have very different impacts in different settings.

Affected people identify who could be affected, directly or indirectly, including vulnerable groups. Indirect effects, such as on families or communities, are easy to overlook.

Potential impacts cover effects on fairness and non-discrimination, privacy, safety, access to services, freedom of expression and other rights, as well as wider social and environmental effects.

Severity and likelihood consider how serious, widespread, reversible and probable each impact is. Irreversible harms deserve special attention even when they seem unlikely.

Mitigations describe measures such as design changes, human oversight, notices, appeal routes and monitoring. Each mitigation should have an owner and a way to check that it works.

Consultation records input from affected groups, experts and internal stakeholders where appropriate.

Types of Impact Assessments

Algorithmic impact assessments focus on automated decision systems, especially in the public sector. They often produce an impact level that sets the safeguards required.

Fundamental rights impact assessments, under the EU AI Act, focus on risks to rights such as non-discrimination and privacy for specific high-risk uses.

Data protection impact assessments, required under the GDPR for high-risk processing of personal data, often overlap and can be combined. Combining them avoids asking teams the same questions twice.

AI system impact assessments under ISO 42001 consider consequences for individuals, groups and society as part of an AI management system.

Importance of AI Impact Assessments in AI Governance

Impact assessments protect people. They surface potential harms before a system is deployed, when it is easiest to change. They also help ensure that the people most affected are considered.

They meet legal requirements. Several laws and standards require impact assessments for specific AI uses.

They also improve decisions and trust. Considering affected people's perspectives leads to better designs and gives the organization a documented basis for its choices. That record is valuable if decisions are later challenged.

AI Impact Assessments and Financial Management

Identifying harms early avoids the cost of redesigning or withdrawing systems after deployment.

Assessments may show that a use case needs significant safeguards, which should be weighed against its expected benefits before investment.

Combining impact, data protection and risk assessments into one process reduces duplicate effort.

Documented assessments can reduce legal exposure by showing that potential harms were considered and addressed.

Common Challenges

Assessments can become box-ticking exercises completed after key decisions have already been made. Starting early and linking assessments to approval decisions avoids this.

Organizations may lack the expertise or relationships to consult affected groups meaningfully. Partnering with advocacy groups or researchers can help.

Some impacts, such as long-term social effects, are hard to predict or measure. Monitoring after deployment helps reveal impacts that were not foreseen.