What is an AI impact assessment?
An AI impact assessment looks at each AI system and records who it affects, what could go wrong for them, how likely and how severe that would be, and what is done about it. ISO 42001 requires one, and the EU AI Act requires its own forms of assessment for high-risk systems.
What it covers
ISO 42001 asks you to assess the potential consequences of an AI system for individuals, groups of individuals and society, across its intended use and foreseeable misuse. A usable assessment answers four sets of questions.
- Purpose and context. What the system does, where it runs, who uses it, and which decisions it influences.
- Affected people. Users, the people its outputs are about, and any group that could be treated differently.
- Possible harms. Unfair outcomes, errors, privacy intrusion, safety effects, and whether a person can challenge a decision.
- Measures. Human oversight, testing, data controls and notices, and who signs off the impact that remains.
How it differs from a risk assessment
An AI risk assessment, under clause 6.1.2, asks what could go wrong for the organisation and its objectives. An impact assessment looks outwards at the people and groups the system touches. A model can be low risk to the company and still have a high impact on the people it scores, so ISO 42001 keeps the two as separate requirements and expects the impact results to inform risk treatment.
Clause 8.4 then requires the assessment to be carried out at planned intervals and when significant changes occur, with the results kept as documented information. Annex A of ISO 42001 adds controls on the assessment process, its documentation, and impacts on individuals and on society.
The EU AI Act and GDPR
Under the EU AI Act, providers of high-risk systems must run a risk management system across the system’s lifecycle (Article 9). Certain deployers of high-risk systems, including public bodies, private organisations providing public services, and those using AI for credit scoring or for pricing life and health insurance, must carry out a fundamental rights impact assessment before first use (Article 27).
Where personal data is involved, a GDPR data protection impact assessment under Article 35 may also be required. The AI Act says the fundamental rights assessment complements the DPIA where they overlap. One well-built assessment can feed all three, as long as each regime’s required content is covered.
Questions
AI impact assessment, answered
Is an AI impact assessment the same as a DPIA?
No, though they overlap. A DPIA under GDPR covers risks to people from processing their personal data. An AI impact assessment covers the wider effects of an AI system, including effects that involve no personal data at all. Where both apply, many organisations run them together and cross-reference the results.
When should it be done?
Before the system goes into use, then at planned intervals and whenever the system, its data or the way it is used changes significantly. ISO 42001 expects the results to be kept as documented information.
Who should take part?
The system owner, someone who understands the model and its data, legal or privacy, and where possible people who can speak for those affected.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them