Most AI projects get a technical review before launch. Far fewer get a structured look at what the system will do to the people on the receiving end. That gap is exactly what an AI impact assessment is meant to close. It asks who is affected, how badly things could go wrong, and what the organization plans to do about it before the model goes live. This guide covers the process, a working template and a few examples you can adapt. If you want formal grounding in this kind of work, the Certified Responsible AI Expert program from Universal Business Council is a good place to build it.

What is an AI impact assessment?

An AI impact assessment is a documented review of how an AI system could affect individuals, groups and the organization itself. It happens before deployment and gets repeated as the system changes. It looks past accuracy scores. A model can hit every technical target and still shut qualified people out of a loan, a job or a service.

The assessment sits somewhere between a privacy impact assessment and a security review, but it covers ground neither of them reaches: fairness, transparency, human oversight, and the effect on people who never agreed to be part of the system. Some regulators call the same idea an algorithmic impact assessment. The labels differ. The job is the same.

Why more teams are being asked for an AI impact assessment

Pressure is coming from several directions at once. Regulators are writing assessments into law. The EU AI Act requires certain deployers of high-risk systems to assess the impact on fundamental rights, and Canada's federal government expects institutions to complete an Algorithmic Impact Assessment before an automated decision system goes into production. Enterprise buyers now ask vendors for assessment documents during procurement. Internal risk teams want a record they can point to when something goes wrong.

Even without a legal trigger, an AI impact assessment pays for itself. A bias problem found in a design review costs a meeting. The same problem found after launch costs a retraction, and sometimes a regulator's attention.

When to run an AI impact assessment

Run one at these points:

Before a new AI system goes into production
Before an existing system is used for a new purpose or a new group of people
When the training data, the model or the vendor changes in a meaningful way
When a tool influences decisions about hiring, credit, health, housing, education or access to services
When you buy an AI product and the vendor cannot show you its own assessment

A low-stakes internal summarizer and a loan approval model do not need the same depth. Scale the effort to the stakes.

The AI impact assessment process, step by step

Most teams can finish the process in a few working sessions. Here is how it usually runs.

Scope the system

Write down what the system does, which decisions it makes or informs, what data it uses and who owns it. Be specific about purpose. "Improve customer experience" is not a purpose. "Rank support tickets by urgency" is.

Map who is affected

List the users, but also the people the system acts on: applicants, patients, customers, employees, and anyone whose data trained the model. Note which groups might be affected differently from the rest.

Identify harms and benefits

Look at both sides. Harms can be unfair outcomes, privacy loss, wrong decisions with no way to appeal, security exposure or plain misuse. Benefits matter too, because the real question is whether the trade is worth making.

Rate likelihood and severity

Score each harm on how likely it is and how serious it would be. A simple three-level scale works. Harms that are severe or hard to reverse deserve attention even when they look unlikely.

Decide on controls

For each risk that matters, name a control and an owner. That might be human review, better data, a narrower scope, a user notice, an appeal route or a monitoring threshold. A risk with no owner is just a worry written down.

Sign off and monitor

Someone with real authority approves the system, rejects it or sends it back. Then set a review date and the events that should trigger a fresh look. An assessment filed once and forgotten describes a system that no longer exists.

An AI impact assessment template you can copy

Keep the template short enough that people will actually fill it in. A workable version has these fields:

System name, owner and business purpose
Decisions the system makes or supports, and whether a person reviews them
Data sources, including any personal or sensitive data
Affected groups inside and outside the organization
Potential harms and benefits for each group
Likelihood and severity ratings
Controls, owners and deadlines
Residual risk after the controls are in place
Approval decision, approver and date
Next review date and reassessment triggers

Extra fields for regulated sectors

Applicable laws, standards and internal policies
Where data is stored, transferred and how long it is kept
Notes from any consultation with affected groups

AI impact assessment examples

The scenarios below are illustrative. They are not drawn from any specific company.

Resume screening tool

Applicants and recruiters are the affected groups. The main risk is that the model learns from past hiring patterns and quietly ranks down groups that were underrepresented. Controls include testing outcomes across groups before launch, keeping a recruiter in the loop on every rejection, and giving candidates a way to ask for a second look.

Customer support chatbot

The risks here are confident wrong answers, leaked account details, and customers who do not realize they are talking to a machine. Restrict what data the bot can reach, show a clear disclosure, and send billing disputes and complaints to a person.

Marketing personalization engine

The concerns are targeting based on sensitive inferences and profiling that customers never expected. Exclude sensitive categories, honor opt-outs and review audience segments on a schedule. Marketers who want to understand where personalization and consent meet can look at the Certified Digital Marketing Expert program.

Who needs to be in the room

An AI impact assessment written by one person tends to carry one person's blind spots. Bring in the product owner, an engineer or data scientist, someone from legal or compliance, a security lead and, where possible, a voice for the affected users. Engineers who want a deeper grip on the systems they are assessing can build it through the programming and technology certifications from Global Tech Council. Keep the group small. What matters is that every question has someone who can answer it.

Keeping the record honest

An assessment is only worth something if it can be trusted later. Store every version, never overwrite old copies, and tie each one to the model and dataset it covered.

What to store with each version

The completed assessment with dates and approvers
Test results and bias checks
Model, dataset and vendor versions
Monitoring logs and any incident notes

Teams working with ledger-based records or other emerging systems can look at the deep tech certifications from Blockchain Council to see how tamper-evident logging works in practice. The people doing the assessing deserve a check as well. If you bring in outside reviewers or hire for an AI governance role, a skills test shows who can really do the job. HireValid offers AI-proof pre-employment tests with an Integrity Score that supports human review. The final hiring decision stays with you.

Conclusion: what a good AI impact assessment delivers

An AI impact assessment is a written review of how an AI system could affect people and the organization, done before launch and repeated when things change. The process is short enough to run in a few working sessions: scope the system, map who it touches, list the harms and benefits, rate them, assign controls and sign off with a review date. The template above fits on a couple of pages, and the examples show how the same structure works for a hiring tool, a chatbot and a personalization engine.

Regulators in the EU and Canada already expect assessments for certain systems, and buyers increasingly ask for them, so this paperwork is moving from optional toward expected. The teams that handle it well keep the working group small but varied, tie every risk to an owner, keep versioned records and set clear triggers for reassessment. Start with your highest-stakes system and run an AI impact assessment on it this month. Then use what you learn to build a lighter version for everything else. For structured training that supports this work, the Certified Responsible AI Expert program mentioned at the start is a sensible next step.

FAQs

1. What is an AI impact assessment?

It is a documented review of how an AI system could affect people, groups and the organization, done before deployment and repeated as the system changes.

2. Is an AI impact assessment legally required?

It depends on where you operate and what the system does. The EU AI Act and Canada's federal directive on automated decisions both require assessments in certain cases, so check the rules that apply to you.

3. How is it different from a data protection impact assessment?

A data protection impact assessment focuses on personal data risks. An AI impact assessment also covers fairness, transparency, human oversight and wider effects on people.

4. Who is responsible for carrying it out?

The system owner usually leads, with support from legal, risk, security and data science teams.

5. When should it be done?

Before deployment, and again whenever the purpose, data, model or vendor changes in a meaningful way.

6. How long does an assessment take?

A low-risk tool may take a few days. A high-stakes system can take several weeks, mostly because of testing and stakeholder input.

7. Does every AI system need one?

No. Match the depth to the risk, with a light check for low-stakes tools and a full review for decisions that affect people's lives.

8. What should an AI impact assessment template include?

Purpose, data sources, affected groups, harms and benefits, risk ratings, controls with owners, an approval decision and a review date.

9. How often should it be updated?

On a fixed schedule, such as yearly, and any time the system or its use changes significantly.

10. What is the difference between an AI impact assessment and an AI risk assessment?

A risk assessment rates threats to the organization. An impact assessment centers on effects on people and society. Many teams combine the two.

11. Can small companies do an AI impact assessment?

Yes. A short template and a small working group are enough to get started.

12. Do we need to assess third-party AI tools?

Yes. Ask the vendor for its documentation, then assess the tool for your own use case and your own users.

13. Who approves the results?

A senior owner with real authority, such as a risk committee or an executive sponsor.

14. What counts as a high-risk AI system?

Systems that influence access to jobs, credit, health care, education, housing or public services are commonly treated as high risk.

15. Should the results be made public?

Sometimes. Public bodies often publish them, while private companies decide case by case and protect confidential details.

16. What happens if the assessment finds a serious risk?

Add controls, narrow the scope, delay the launch or drop the project if the risk cannot be reduced enough.

17. How is bias measured in an assessment?

Teams compare outcomes and error rates across groups using agreed metrics, and they record the limits of those tests.

18. Can AI tools help complete the assessment?

They can help draft and organize it, but people must judge the risks and sign off.

19. What records should be kept?

Every version of the assessment, test results, model and data versions, approvals and monitoring logs.

20. How can I learn to run an AI impact assessment?

Structured training such as the Certified Responsible AI Expert program helps, and frameworks like the NIST AI Risk Management Framework and ISO/IEC 42001 make useful references.