AI impact assessment
What it means
What is an AI impact assessment?
An AI impact assessment is a written review of who a high-risk AI system affects and what could go wrong for them, completed before launch. It also asks whether someone wrongly affected has a real way to challenge the system's decision, not just a right to ask a question.
The EU AI Act calls this a fundamental rights impact assessment. Article 27 requires it from deployers that are public-law bodies or private entities delivering a public service. It also applies to any deployer using a high-risk system to score creditworthiness. The same goes for pricing life and health insurance.
The assessment has to name the process the system sits inside, how often it runs, and which people or groups it is likely to affect. It has to describe the human oversight in place, and the governance and complaint routes that take effect if a risk appears. The deployer sends the finished assessment to the national market surveillance authority.
Article 27 lets this assessment build on an existing data protection impact assessment rather than repeat it. Where the two overlap, the newer document only has to add what the DPIA does not already answer.
Published · Updated
In practice
Why it comes up
It comes up wherever an AI system’s output changes the offer a real person gets. That includes a loan, a job interview, an insurance price or a public benefit. A board hears about it once a pilot nears launch and legal asks who reviewed fairness before customers saw it. Procurement teams increasingly expect a written answer rather than a verbal assurance, since the assessment itself is what a regulator can ask to see.
What to do about it
Name the specific groups the system could disadvantage before launch. Use the actual decision it makes and who it makes it about. Write down the mitigation for each risk identified, and who checked that the mitigation actually works rather than just exists on paper. Before a customer’s legal team asks, I flag which systems need this specific assessment inside the AI readiness and risk assessment.
Sources and neighbours
Sources
- Article 27 - Fundamental Rights Impact Assessment for High-Risk AI Systems
eur-lex.europa.eu
- Article 35 GDPR - Data protection impact assessment
eur-lex.europa.eu
Related terms
Concerns