{"data":{"slug":"ai-impact-assessment","title":"AI Impact Assessment","type":"assessment","formats":["docx","xlsx"],"topics":["risk","governance","evidence"],"frameworks":["nist-ai-rmf","iso-42001","colorado-ai-act"],"short":"A general impact assessment for any AI system: purpose, affected people, harms by risk domain, mitigations and the decision, with the impact-assessment duties recorded across jurisdictions as the checklist.","covers":{"categories":["impact_assessment","risk_management"]},"version":6,"dataset_version":"ef1018b7a6a2","generated_at":"2026-11-12T05:14:17+00:00","citations":14,"downloads":15,"files":[{"format":"docx","filename":"ai-impact-assessment-v6.docx","bytes":12819,"url":"https://aipolicytracker.org/templates/ai-impact-assessment#download"},{"format":"xlsx","filename":"ai-impact-assessment-v6.xlsx","bytes":18358,"url":"https://aipolicytracker.org/templates/ai-impact-assessment#download"}],"url":"https://aipolicytracker.org/templates/ai-impact-assessment","inside":["Document: purpose, scope, affected groups, harm analysis by MIT risk domain, mitigations, residual risk, decision and sign-off","Duties sheet: every recorded impact-assessment duty, by jurisdiction and instrument","Harm areas sheet: the 24 MIT subdomains as prompts"],"legal_basis":["us-colorado-automated-decision-making-technology-act","eu-ai-act","us-nist-ai-rmf"],"caveat":null,"covered_obligations":[{"slug":"us-california-ccpa-risk-assessment","title":"Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions","policy":"us-california-cppa-admt-regulations","source_reference":"Cal. Code Regs. tit. 11, §§ 7150, 7155","url":"https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment"},{"slug":"eu-ai-act-risk-management-system","title":"Establish a risk management system for high-risk AI","policy":"eu-ai-act","source_reference":"Article 9","url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system"},{"slug":"eu-ai-act-fundamental-rights-impact-assessment","title":"Carry out a fundamental rights impact assessment before deployment","policy":"eu-ai-act","source_reference":"Article 27","url":"https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment"},{"slug":"india-dpdp-significant-data-fiduciary-duties","title":"Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits","policy":"india-dpdp-act","source_reference":"Section 10","url":"https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties"},{"slug":"us-new-york-gbl-1701-self-harm-protocol","title":"Offer an AI companion only if it contains a protocol to detect suicidal ideation or self-harm and refer users to crisis services","policy":"us-new-york-ai-companion-safeguards","source_reference":"N.Y. Gen. Bus. Law § 1701","url":"https://aipolicytracker.org/obligations/us-new-york-gbl-1701-self-harm-protocol"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","title":"Operators of high-impact AI must establish and operate a risk management plan","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 34(1)","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan"},{"slug":"south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment","title":"Operators of high-impact AI should assess its impact on fundamental rights before use","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 35","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment"},{"slug":"uae-pdpl-impact-assessment-new-technologies","title":"Conduct a data protection impact assessment for high-risk processing using new technologies","policy":"uae-personal-data-protection-law","source_reference":"Article on data protection impact assessment (reviewer to cite article number)","url":"https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies"},{"slug":"uk-principles-safety-security-robustness","title":"Ensure AI systems are safe, secure and robust throughout their lifecycle","policy":"uk-ai-regulation-white-paper","source_reference":"Principle 1, Part 3","url":"https://aipolicytracker.org/obligations/uk-principles-safety-security-robustness"},{"slug":"uk-ico-dpia-for-ai","title":"Carry out a data protection impact assessment for high-risk AI processing","policy":"uk-ico-ai-data-protection-guidance","source_reference":"UK GDPR Article 35; ICO guidance, accountability and governance section","url":"https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai"},{"slug":"us-nist-ai-rmf-map","title":"Map context, intended use and potential impacts (Map)","policy":"us-nist-ai-rmf","source_reference":"MAP function","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map"},{"slug":"us-nist-ai-rmf-manage","title":"Prioritise, respond to and monitor AI risks (Manage)","policy":"us-nist-ai-rmf","source_reference":"MANAGE function","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage"},{"slug":"us-omb-m-25-21-high-impact-ai-practices","title":"Apply minimum risk-management practices to high-impact AI","policy":"us-omb-m-25-21","source_reference":"Section 4","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices"},{"slug":"us-washington-eshb-2225-self-harm-protocol","title":"Keep and run a protocol to detect suicidal ideation and self-harm and refer users to crisis resources","policy":"us-washington-eshb-2225-ai-companion-chatbots","source_reference":"ESHB 2225 (Chapter 168, Laws of 2026), sec. 5(1) and (2)","url":"https://aipolicytracker.org/obligations/us-washington-eshb-2225-self-harm-protocol"}],"versions":[{"version":6,"generated_at":"2026-11-12T05:14:17+00:00","dataset_version":"ef1018b7a6a2","changelog":"Dataset 4559f86f527b → ef1018b7a6a2. Sheet \"Duties by jurisdiction\": 6 → 7 rows (+1). Document: 48 → 54 blocks. Record citations: 12 → 14.","stats":{"sheets":{"Harm areas":24,"Duties by jurisdiction":7},"blocks":54,"headings":13,"citations":14}},{"version":5,"generated_at":"2026-10-16T05:30:02+00:00","dataset_version":"4559f86f527b","changelog":"Dataset 1e8ea28a8a93 → 4559f86f527b.","stats":{"sheets":{"Harm areas":24,"Duties by jurisdiction":6},"blocks":48,"headings":12,"citations":12}},{"version":4,"generated_at":"2026-10-09T05:30:01+00:00","dataset_version":"1e8ea28a8a93","changelog":"Dataset 52bd836b1d6b → 1e8ea28a8a93.","stats":{"sheets":{"Harm areas":24,"Duties by jurisdiction":6},"blocks":48,"headings":12,"citations":12}},{"version":3,"generated_at":"2026-10-08T05:30:01+00:00","dataset_version":"52bd836b1d6b","changelog":"Dataset 3335c39da4b7 → 52bd836b1d6b.","stats":{"sheets":{"Harm areas":24,"Duties by jurisdiction":6},"blocks":48,"headings":12,"citations":12}},{"version":2,"generated_at":"2026-09-27T05:30:01+00:00","dataset_version":"3335c39da4b7","changelog":"Dataset 914895c3103e → 3335c39da4b7. Sheet \"Duties by jurisdiction\": 7 → 6 rows (-1). Document: 54 → 48 blocks. Record citations: 14 → 12.","stats":{"sheets":{"Harm areas":24,"Duties by jurisdiction":6},"blocks":48,"headings":12,"citations":12}},{"version":1,"generated_at":"2026-09-26T13:05:14+00:00","dataset_version":"914895c3103e","changelog":"First version, built from dataset 914895c3103e.","stats":{"sheets":{"Harm areas":24,"Duties by jurisdiction":7},"blocks":54,"headings":13,"citations":14}}]},"meta":{"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","disclaimer":"This template is generated from the records on aipolicytracker.org. It is an informational resource, not legal advice, and completing it does not make an organisation compliant with any law or standard. Every row that cites a duty links to the record it came from; check the official source before relying on it."}}