An AI impact assessment asks who outside the company could be harmed.

Most risk reviews ask what could go wrong for the company. An AI impact assessment turns the question around: who could this system affect, and how? It looks at the people the system decides about, the groups it might treat unfairly, and the wider effects of using it at scale.

Several frameworks now expect one. ISO/IEC 42001 requires an organisation to assess the potential consequences of its AI systems for individuals, groups and society, and to use the result in its risk work; its Annex A carries matching controls. ISO/IEC 42005 gives guidance on how to run such an assessment. The EU AI Act asks certain deployers of high-risk systems, such as public bodies and some lenders and insurers, to complete a fundamental rights impact assessment before first use. The NIST AI Risk Management Framework's MAP function also centres on understanding context and impacts. For a buyer, a well-run assessment shows the supplier has thought about the people at the far end of the model, not only about uptime.

ISO/IEC 42001 clause 6.1.4

The requirement to assess AI system impacts, with related controls in Annex A.

ISO/IEC 42005

International guidance on how to carry out and document an AI system impact assessment.

EU AI Act Article 27

The fundamental rights impact assessment some deployers of high-risk systems must complete.

A product launch review

Where the assessment feeds the go or no-go decision and the conditions on release.

AI risk assessment

Looks at risks to the organisation's objectives. The impact assessment looks at effects on people and society. ISO/IEC 42001 asks for both and links them.

DPIA

A data protection impact assessment covers risks to people from processing personal data. An AI impact assessment is wider: an AI system can cause harm without personal data, and a DPIA may cover only part of the picture.

Fundamental rights impact assessment

A specific EU AI Act duty for certain deployers of high-risk systems. It is one kind of AI impact assessment, with a set scope and a notification step.

• Name the people and groups each AI system could affect, including those who never use it directly.
• Record the plausible harms, their likelihood and severity, and the measures you will take.
• Link each finding to your AI risk register and your DPIA where personal data is involved.
• Repeat the assessment when the model, data or use changes, and keep the versions.

• GuideAI risk vs impact assessmentTwo assessments: inward risk and outward impact, and the register.
• GuideISO 42001 and the EU AI ActLaw vs standard, the risk tiers, dates, and the article-by-article map.
• GuideISO 42001 Annex A controlsAll 38 controls across nine objectives, A.2 to A.10.

Sources: ISO/IEC 42001:2023 public description, clause 6.1.4 and Annex A titles; ISO/IEC 42005 public description; Regulation (EU) 2024/1689 (EU AI Act), Article 27 and Annex III; NIST AI Risk Management Framework 1.0 (NIST AI 100-1).