AI impact assessment
Definition
An assessment of the foreseeable effects of an AI system on individuals, groups and society, documented before deployment and revisited when the system or its use changes.
An AI impact assessment, often called an algorithmic impact assessment, looks outward: instead of asking what could go wrong for the organization, it asks who could be affected by the system and how. ISO/IEC 42001 requires organizations to assess impacts on individuals and societies, and ISO/IEC 42005 gives guidance on how to do it. Canada's Directive on Automated Decision-Making uses a scored questionnaire whose result sets the controls a public body must apply.
Typical content includes the purpose and context, affected groups, potential harms (discrimination, loss of access to services, privacy intrusion, safety), mitigation measures and residual impact. It overlaps with a DPIA when personal data is processed and with a FRIA for certain deployers under the EU AI Act; many organizations run one integrated assessment to avoid duplication.
Example: a city planning to rank welfare applications with a model documents the impact on vulnerable households and decides that caseworkers, not the score, make the final call.
Where this term is assessed
Assessed in the Responsible AI Practitioner (RAIP), domain 2: Risk and impact assessment.
Also covered in: Responsible AI Auditor (AUDAI)
Primary sources
- ISO/IEC 42005:2025
- ISO/IEC 42001:2023, clause 6.1.4
- Government of Canada Directive on Automated Decision-Making