{"slug":"ai-impact-assessment","id":"AIPT-CTL-0003","title":"AI impact and fundamental-rights impact assessment","kind":"process","kind_label":"Process","purpose":"Examines how a planned AI use will affect the people, groups and communities it touches, with particular attention to discrimination and rights, and records the mitigations chosen before the system goes live.\n","description":"Before deployment, and again on material change or a set anniversary, the deploying team completes a templated assessment that describes the use, the decisions or outputs it influences, the people affected and the ways they could be harmed. It examines disparate effects across relevant groups, consults affected stakeholders where practical, and documents the transparency, oversight and monitoring measures that will accompany the deployment. The template is designed so that a single exercise can produce the outputs that data-protection, algorithmic-discrimination and rights-based regimes each expect. Completed assessments are retained for the period the strictest applicable rule requires and are available to regulators on request.\n","owner_role":"AI system owner","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["1.1","1.3","5.2","6.2"],"evidence":[{"type":"impact_assessment","title":"AI impact assessment","description":"Completed assessment of purpose, affected people, discrimination risk, mitigations and monitoring plan."},{"type":"approval_record","title":"Impact assessment approval","description":"Sign-off by the accountable owner and, where required, the privacy or legal function."},{"type":"procedure","title":"Impact assessment procedure and template","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 6.1.4, 8.4; Annex A.5","note":null,"confidence_level":"high"},{"framework":"iso_42005","framework_name":"ISO/IEC 42005:2025","reference":"ISO/IEC 42005 Clause 5, 6","note":"Guidance on running and documenting AI system impact assessments.","confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 5.1, 5.2; MEASURE 2.11","note":null,"confidence_level":"high"},{"framework":"oecd_ai_principles","framework_name":"OECD AI Principles","reference":"Principle 1.2 Human-centred values and fairness","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-fundamental-rights-impact-assessment","title":"Carry out a fundamental rights impact assessment before deployment","relationship":"satisfies","note":"A rights-focused assessment template covering the required elements.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment"},{"slug":"eu-ai-act-art-26-7-worker-information","title":"Employers must inform workers and their representatives before using high-risk AI at work","relationship":"supports","note":"Identifies the affected worker groups to notify.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information"},{"slug":"eu-ai-act-art-26-9-dpia-using-provider-information","title":"Deployers must use the provider's transparency information in their data protection impact assessment","relationship":"supports","note":"Shared inputs with the fundamental rights impact assessment.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information"},{"slug":"india-dpdp-significant-data-fiduciary-duties","title":"Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits","relationship":"supports","note":"Assessment content can be shared with the DPIA.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties"},{"slug":"uk-principles-fairness","title":"Use AI in ways that are fair and do not discriminate unlawfully","relationship":"supports","note":"Identifies groups at risk of unfair treatment.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-fairness"},{"slug":"uk-ico-dpia-for-ai","title":"Carry out a data protection impact assessment for high-risk AI processing","relationship":"supports","note":"Bias, explainability and oversight analysis reused in the DPIA.","confidence_level":"medium","is_binding":true,"policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai"},{"slug":"us-nist-ai-rmf-map","title":"Map context, intended use and potential impacts (Map)","relationship":"satisfies","note":"Context, affected people and impact analysis produced before development.","confidence_level":"medium","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map"},{"slug":"south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment","title":"Operators of high-impact AI should assess its impact on fundamental rights before use","relationship":"satisfies","note":"Fundamental-rights assessment before deployment.","confidence_level":"high","is_binding":false,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment"},{"slug":"uae-pdpl-impact-assessment-new-technologies","title":"Conduct a data protection impact assessment for high-risk processing using new technologies","relationship":"supports","note":"Broader impact analysis feeds the DPIA.","confidence_level":"medium","is_binding":true,"policy":"uae-personal-data-protection-law","jurisdiction":"uae","url":"https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies"},{"slug":"us-colorado-deployer-impact-assessment","title":"Deployers must complete impact assessments for high-risk AI","relationship":"satisfies","note":"Templated assessment aligned to the statutory elements, refreshed annually and on material change.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment"},{"slug":"us-omb-m-25-21-high-impact-ai-practices","title":"Apply minimum risk-management practices to high-impact AI","relationship":"supports","note":"AI impact assessment content.","confidence_level":"medium","is_binding":true,"policy":"us-omb-m-25-21","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices"}],"related_controls":["ai-risk-assessment","privacy-and-data-protection-for-ai","human-oversight-and-override","ai-interaction-and-use-disclosure"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-impact-assessment","context_url":"https://aipolicytracker.org/controls/ai-impact-assessment.md"}