# AI Impact Assessment

- **Type**: Template (Assessment)
- **Page**: https://aipolicytracker.org/templates/ai-impact-assessment
- **Formats**: DOCX and XLSX
- **Current version**: v6, built 2026-11-12

A general impact assessment for any AI system: purpose, affected people, harms by risk domain, mitigations and the decision, with the impact-assessment duties recorded across jurisdictions as the checklist.

## What is inside

- Document: purpose, scope, affected groups, harm analysis by MIT risk domain, mitigations, residual risk, decision and sign-off
- Duties sheet: every recorded impact-assessment duty, by jurisdiction and instrument
- Harm areas sheet: the 24 MIT subdomains as prompts

## Laws and frameworks it is built from

- EU AI Act (European Union), Pending review · source-linked, checked 26 Sep 2026: https://aipolicytracker.org/policies/eu-ai-act
- Colorado ADMT law (SB 26-189) (Colorado (United States)), Pending review · source-linked, checked 26 Sep 2026: https://aipolicytracker.org/policies/us-colorado-automated-decision-making-technology-act
- NIST AI RMF (United States), Verified against the official source 26 Sep 2026: https://aipolicytracker.org/policies/us-nist-ai-rmf

## Recorded duties it covers

- Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment
- Establish a risk management system for high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system
- Carry out a fundamental rights impact assessment before deployment (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment
- Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits (India DPDP Act): https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties
- Offer an AI companion only if it contains a protocol to detect suicidal ideation or self-harm and refer users to crisis services (New York AI companion safeguards): https://aipolicytracker.org/obligations/us-new-york-gbl-1701-self-harm-protocol
- Operators of high-impact AI must establish and operate a risk management plan (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan
- Operators of high-impact AI should assess its impact on fundamental rights before use (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment
- Conduct a data protection impact assessment for high-risk processing using new technologies (UAE PDPL): https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies
- Ensure AI systems are safe, secure and robust throughout their lifecycle (UK AI regulation framework): https://aipolicytracker.org/obligations/uk-principles-safety-security-robustness
- Carry out a data protection impact assessment for high-risk AI processing (ICO AI guidance): https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai
- Map context, intended use and potential impacts (Map) (NIST AI RMF): https://aipolicytracker.org/obligations/us-nist-ai-rmf-map
- Prioritise, respond to and monitor AI risks (Manage) (NIST AI RMF): https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage
- Apply minimum risk-management practices to high-impact AI (OMB M-25-21): https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices
- Keep and run a protocol to detect suicidal ideation and self-harm and refer users to crisis resources (Washington AI companion chatbot law (ESHB 2225)): https://aipolicytracker.org/obligations/us-washington-eshb-2225-self-harm-protocol

## Latest changes

Dataset 4559f86f527b → ef1018b7a6a2. Sheet "Duties by jurisdiction": 6 → 7 rows (+1). Document: 48 → 54 blocks. Record citations: 12 → 14.

- **Retrieved**: 2026-11-12
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> Built from structured summaries of official texts. Not legal advice. A record whose review status is not "verified" has not been confirmed against its official source by a named reviewer; open the official source before relying on any date or duty. How records are verified: https://aipolicytracker.org/verification.