What is an AI impact assessment?
By Nick Jang, founder of MINERVA Studio ·
The short answer
An AI impact assessment is a structured look at how an AI system could affect people, before it goes live and again when it changes: who it touches, what could go wrong for them, what good it does, and what you’ll do about the harms. It differs from a risk assessment, which asks what could go wrong for the organization. The main references are ISO/IEC 42005:2025, Canada’s Algorithmic Impact Assessment for federal automated decisions, and the EU AI Act’s fundamental rights impact assessment for certain deployers, including those using AI for credit scoring and life or health insurance pricing.
Impact, risk and privacy assessments
| Assessment | Main question | Looks at |
|---|---|---|
| AI impact assessment | What could this system do to people and society? | Individuals, groups and society: fairness, access, safety, rights, livelihoods. |
| AI risk assessment | What could go wrong for us? | The organization: losses, legal exposure, reputation, operations. |
| Privacy impact assessment | What happens to personal information? | Collection, use, disclosure and safeguarding of personal data. |
They overlap, and a good impact assessment feeds the other two. A biased credit model is a harm to applicants and a legal and reputational risk to the lender. But the starting point differs, and a team that only asks the second question tends to miss the people who never complain.
What goes in one
Whatever framework you follow, a usable assessment answers these:
- The system and its use: what it does, the decision it supports, and whether a person reviews its output before it takes effect.
- Who is affected: customers, applicants, staff, the public; and groups that could be affected differently.
- Foreseeable harms: wrong decisions, unfair outcomes, loss of access, privacy intrusion, manipulation, safety, and misuse of the system for something it wasn’t meant for.
- Benefits: what gets better, and for whom.
- Severity and likelihood of each harm, and whether it can be undone.
- Mitigations: testing, human review, limits on use, explanations, an appeal route, monitoring.
- The residual judgement: is what’s left acceptable, and who decided?
- When it’s looked at again: a date, and the changes that trigger an earlier look.
Canada’s Algorithmic Impact Assessment
Federal departments must complete the Treasury Board’s Algorithmic Impact Assessment (AIA) under the Directive on Automated Decision-Making. It’s a questionnaire of 65 risk questions and 41 mitigation questions. The risk answers give a raw impact score; strong mitigation (80% or more of the mitigation points) takes 15% off it. The result places the system at one of four levels:
| Level | Impact | Share of the maximum score |
|---|---|---|
| I | Little to no impact | 0 to 25% |
| II | Moderate impact | 26 to 50% |
| III | High impact | 51 to 75% |
| IV | Very high impact | 76 to 100% |
The level sets the requirements, such as peer review, human involvement in decisions and who approves. The AIA is done at the start of design and again before production, updated when the system changes, and the final results are published on the Open Government Portal. It’s written for government, but it’s free and public, and private firms use it as a starting template.
The EU AI Act and ISO/IEC 42005
Under the EU AI Act, Article 27 requires a fundamental rights impact assessment from certain deployers of high-risk AI systems: public bodies, private entities providing public services, and deployers of systems that assess creditworthiness or price life and health insurance. It must be done before first use, updated if things change, and the market surveillance authority must be notified. Where a GDPR data protection impact assessment already covers part of it, the two complement each other.
ISO/IEC 42005:2025, published in May 2025, is international guidance on how to run an AI system impact assessment: when in the life cycle, what to document, and how it fits with the rest of AI risk management. It isn’t a certification. It pairs with ISO/IEC 42001, whose management system requires organizations to assess the impact of their AI systems.
In a bank
OSFI’s E-23 doesn’t use the term, but customer impact is one of the factors it names for a model’s risk rating, and Quebec’s AMF guideline on AI expects fair treatment of clients wherever an institution uses AI. An impact assessment is the natural place to show that work.
MINERVA records the result of an AI system’s impact assessment on its record (the harms, benefits, mitigations, the residual judgement, who assessed it and when, and when it’s due again) and can hold the system’s approval until the assessment is done. See AI governance software.
Related questions
What is the difference between an AI impact assessment and an AI risk assessment?
An impact assessment asks what an AI system could do to people and society. A risk assessment asks what could go wrong for the organization. They overlap, and the impact assessment usually feeds the risk assessment.
Is an AI impact assessment mandatory?
For some. Canadian federal departments must complete the Algorithmic Impact Assessment for automated decision systems; the EU AI Act requires a fundamental rights impact assessment from certain deployers of high-risk AI; ISO/IEC 42001 requires one for certified management systems. Elsewhere it is good practice.
What are the four levels of Canada’s Algorithmic Impact Assessment?
Level I little to no impact, Level II moderate, Level III high, and Level IV very high, based on the share of the maximum risk score after mitigation.
What is ISO/IEC 42005?
An international standard, published in 2025, giving guidance on conducting AI system impact assessments: when to do them, what to document and how they fit with AI risk management. It is guidance, not a certification.
When should an AI impact assessment be done?
At design, again before the system goes live, and whenever its purpose, data, model or the people it affects change significantly, plus on a set review date.
Sources
- Government of Canada — Algorithmic Impact Assessment tool
- Treasury Board of Canada Secretariat — Directive on Automated Decision-Making
- European Commission AI Act Service Desk — Article 27, Fundamental rights impact assessment
- ISO — ISO/IEC 42005:2025, AI system impact assessment
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.