AI Impact Assessment
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The AI Impact Assessment is a free DOCX and XLSX assessment for NIST AI RMF, ISO/IEC 42001 and Colorado ADMT law (SB 26-189). A general impact assessment for any AI system: purpose, affected people, harms by risk domain, mitigations and the decision, with the impact-assessment duties recorded across jurisdictions as the checklist.
- Format
- DOCX and XLSX · Assessment
- Version
- v6, built 12 Nov 2026
- Duties cited
- 14 from 11 instruments
- Rows from the records
- 31
- Written for
- Deployer / user organisation, Provider / developer, Public authority / government body
- Price and licence
- Free · CC BY 4.0
What's inside
- Document: purpose, scope, affected groups, harm analysis by MIT risk domain, mitigations, residual risk, decision and sign-off
- Duties sheet: every recorded impact-assessment duty, by jurisdiction and instrument
- Harm areas sheet: the 24 MIT subdomains as prompts
Preview
The sheets and sections of version v6, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Harm areas
| Domain | Harm area | Definition (MIT AI Risk Repository) | Relevant to this system ▾ | Analysis | Mitigation |
|---|---|---|---|---|---|
| Discrimination & Toxicity | Unfair discrimination and misrepresentation | Unequal treatment of individuals or groups by AI, often based on race, gender, or other sensitive characteristics, resulting in unfair outcomes and representati | |||
| Discrimination & Toxicity | Exposure to toxic content | AI exposing users to harmful, abusive, unsafe or inappropriate content. May involve AI creating, describing, providing advice, or encouraging action. Examples o | |||
| Discrimination & Toxicity | Unequal performance across groups | Accuracy and effectiveness of AI decisions and actions is dependent on group membership, where decisions in AI system design and biased training data lead to un | |||
| Privacy & Security | Compromise of privacy by obtaining, leaking or correctly inferring sensitive information | AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized shari | |||
| Privacy & Security | AI system security vulnerabilities and attacks | Vulnerabilities in AI systems, software development toolchains, and hardware that can be exploited, resulting in unauthorized access, data and privacy breaches, | |||
| Misinformation | False or misleading information | AI systems that inadvertently generate or spread incorrect or deceptive information, which can lead to inaccurate beliefs in users and undermine their autonomy. |
Sheet: Duties by jurisdiction
| Duty | Category | Instrument | Jurisdiction | Who it binds | Nature | Source reference | Applies from | What it requires | Evidence a reviewer expects | ISO/IEC 42001 | NIST AI RMF | Verification | Record |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions | Impact assessment | California CPPA automated decision-making rules | California (United States) | Deployer / user organisation | Legal requirement | Cal. Code Regs. tit. 11, §§ 7150, 7155 | 2026-01-01 | A business must conduct and document a risk assessment before starting processing that presents significant risk to consumers' privacy. The listed activities in | The risk assessment for each in-scope activity, with dates, versions and the material changes that triggered updates; The list of processing activities checked | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment | ||
| Carry out a fundamental rights impact assessment before deployment | Impact assessment | EU AI Act | European Union | Deployer / user organisation, Public authority / government body | Legal requirement | Article 27 | 2027-12-02 | Before deploying most Annex III high-risk systems, deployers that are bodies governed by public law or private entities providing public services, and deployers | Fundamental rights impact assessment report | Clause 6.1.4 AI system impact assessment; Annex A control on impact assessment | MAP 5.1, MAP 5.2 | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment |
| Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits | Impact assessment | India DPDP Act | India | Provider / developer, Deployer / user organisation | Legal requirement | Section 10 | Entities notified as Significant Data Fiduciaries, based on factors such as volume and sensitivity of data and risk to individuals, must appoint a Data Protecti | Data protection impact assessment | Clause 6.1.4 AI system impact assessment | Pending review · source-linked | https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties | ||
| Operators of high-impact AI should assess its impact on fundamental rights before use | Impact assessment | AI Basic Act | South Korea | Provider / developer, Deployer / user organisation, Public authority / government body | Voluntary | Article 35 | 2026-01-22 | An AI business operator that provides high-impact AI, or a product or service using it, is to make efforts to assess in advance the impact the AI may have on pe | Fundamental-rights impact assessment for high-impact AI | Clause 6.1.4; Annex A.5.2, A.5.4 | MAP 5.1, MAP 5.2 | Verified against the official source 26 Sep 2026 | https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment |
| Conduct a data protection impact assessment for high-risk processing using new technologies | Impact assessment | UAE PDPL | United Arab Emirates | Provider / developer, Deployer / user organisation | Legal requirement | Article on data protection impact assessment (reviewer to cite article number) | Before processing that uses modern technologies and is likely to pose a high risk to privacy, controllers must assess the impact on personal data protection, co | Data protection impact assessment | Clause 6.1.4 AI system impact assessment | Pending review · source-linked | https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies | ||
| Carry out a data protection impact assessment for high-risk AI processing | Impact assessment | ICO AI guidance | United Kingdom | Provider / developer, Deployer / user organisation, Public authority / government body | Legal requirement | UK GDPR Article 35; ICO guidance, accountability and governance section | Where AI processing of personal data is likely to result in a high risk to individuals, UK GDPR requires a DPIA before processing begins. The ICO treats most AI | Data protection impact assessment | Clause 6.1.4 AI system impact assessment | MAP 5.1 | Pending review · source-linked | https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai |
Document outline (DOCX)
- Scope
- Affected people
- Harm analysis
- Mitigations and residual risk
- Decision
- Duties this assessment serves
- Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions
- Carry out a fundamental rights impact assessment before deployment
- Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits
- Operators of high-impact AI should assess its impact on fundamental rights before use
- Conduct a data protection impact assessment for high-risk processing using new technologies
- Carry out a data protection impact assessment for high-risk AI processing
- Map context, intended use and potential impacts (Map)
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The DOCX and XLSX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v6), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Check the duties against your situation. The "Harm areas" and "Duties by jurisdiction" sheets list the recorded duties with their source references. Mark which apply to you and follow each link to the official text.
- 4Complete the document. Work through the DOCX sections (Scope, Affected people, Harm analysis, Mitigations and residual risk) and replace each placeholder with your organisation's answer.
- 5Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (14)
Each is cited in the file with its source reference and a link back to the record.
- Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions
- Establish a risk management system for high-risk AI
- Carry out a fundamental rights impact assessment before deployment
- Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits
- Offer an AI companion only if it contains a protocol to detect suicidal ideation or self-harm and refer users to crisis services
- Operators of high-impact AI must establish and operate a risk management plan
- Operators of high-impact AI should assess its impact on fundamental rights before use
- Conduct a data protection impact assessment for high-risk processing using new technologies
- Ensure AI systems are safe, secure and robust throughout their lifecycle
- Carry out a data protection impact assessment for high-risk AI processing
- Map context, intended use and potential impacts (Map)
- Prioritise, respond to and monitor AI risks (Manage)
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v6 | ef1018b7a6a2 | Dataset 4559f86f527b → ef1018b7a6a2. Sheet "Duties by jurisdiction": 6 → 7 rows (+1). Document: 48 → 54 blocks. Record citations: 12 → 14. | |
| v5 | 4559f86f527b | Dataset 1e8ea28a8a93 → 4559f86f527b. | |
| v4 | 1e8ea28a8a93 | Dataset 52bd836b1d6b → 1e8ea28a8a93. | |
| v3 | 52bd836b1d6b | Dataset 3335c39da4b7 → 52bd836b1d6b. | |
| v2 | 3335c39da4b7 | Dataset 914895c3103e → 3335c39da4b7. Sheet "Duties by jurisdiction": 7 → 6 rows (-1). Document: 54 → 48 blocks. Record citations: 14 → 12. | |
| v1 | 914895c3103e | First version, built from dataset 914895c3103e. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the AI Impact Assessment?
Document: purpose, scope, affected groups, harm analysis by MIT risk domain, mitigations, residual risk, decision and sign-off. Duties sheet: every recorded impact-assessment duty, by jurisdiction and instrument. Harm areas sheet: the 24 MIT subdomains as prompts.
Which duties does it cite?
14 recorded duties from California CPPA automated decision-making rules, EU AI Act, India DPDP Act and New York AI companion safeguards, including Cal. Code Regs. tit. 11, §§ 7150, 7155, Article 9, Article 27, Section 10, N.Y. Gen. Bus. Law § 1701 and Article 34(1). Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on deployer / user organisation, provider / developer and public authority / government body. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the DOCX and XLSX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v6 was built on 12 November 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Is there a self-assessment that goes with it?
Yes: the AI System Impact Assessment (ISO/IEC 42005) (21 questions, about 6 minutes). It is free and runs on Certifyi, a related product. A score is a self-check, not an audit; this template is where the work it points to gets written down.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.