Does an assessment happen only before launch?

No. It should be revisited as the system and evidence change, including after unexpected effects appear.

Must every impact be reduced to a number?

No. Quantitative measures can help, but qualitative evidence and uncertainty may be essential to understanding the consequence.

Does completing one prove compliance?

No. A general assessment supports governance but does not automatically satisfy every specific legal or contractual requirement.

AI Glossary / Governance, ethics and safety / Intermediate

Impact assessment

Definition

An impact assessment is a structured examination of how a proposed or operating system may affect people, organizations, society, or the environment. For AI, it looks beyond model performance to the consequences of using the system in a particular setting. It identifies potential benefits, harms, affected groups, uncertainties, and actions needed to support a responsible decision.

What it means

A model test asks questions such as whether predictions match reference answers. An impact assessment asks what those predictions will change, who experiences the change, and what happens when the system works poorly or is used differently from the original plan.

Some affected people may never operate the product. A person whose application is ranked, whose work is monitored, or whose information appears in a dataset can be affected without being a direct user.

The term covers several approaches. A general AI assessment is not automatically equivalent to a legally required privacy or fundamental-rights assessment. This entry describes the general governance activity; specific obligations require attention to the relevant jurisdiction, sector, and system.

How it works

Describe the intended use and the decision it informs. Identify affected parties and compare the proposal with relevant alternatives, including the existing process. Gather technical evidence, operational experience, and perspectives from people likely to experience the consequences.

Examine potential effects, their likelihood, severity, distribution, and uncertainty. Consider misuse, failure, and changes after deployment. Record controls and remaining concerns, and connect findings to a decision about proceeding, redesigning, limiting, or stopping the proposed use.

Assign responsibility for actions and follow-up. An assessment should inform what the organization does, not simply fill a file. Revisit it when evidence, functionality, users, or operating conditions change, and provide a route for unexpected effects to be reported and examined.

Three practical examples

1. Before introducing an AI support assistant, a service considers whether incorrect instructions could delay access, which users may struggle to obtain human help, and what recovery options are available.

2. A company assessing an automated scheduling tool examines effects on workers' predictability and workload alongside the potential efficiency of the schedule.

3. A public-facing content service evaluates how generated descriptions might misrepresent people or communities, even when the text is grammatically accurate and technically fluent.

Think of it this way

Think of inspecting the proposed route of a new road before construction. The question is not only whether the road can carry traffic, but also who gains access, who experiences disruption, and what alternatives might meet the need.

The analogy is limited because AI systems can change rapidly and many effects are difficult to observe in advance. An initial assessment cannot settle every future outcome. Its value is in making assumptions and consequences visible and creating a basis for continued learning and decisions.

Worked example

Consider an invented service with 10,000 monthly requests. A proposed assistant could save one minute on each of 6,000 straightforward requests, giving an estimated 6,000 minutes, or 100 hours, of gross time savings.

Testing also identifies a scenario in which 2% of the 10,000 requests might be misrouted: 200 cases. If each misrouting takes five extra minutes to resolve, that adds 1,000 minutes, or about 16.7 hours, of handling work.

Subtracting those figures gives about 83.3 hours of estimated net handling savings under the assumptions. That calculation is only one part of the assessment. A misrouted urgent request may have consequences far beyond five minutes of staff time, and some groups may encounter the problem more often.

The assessment therefore records the arithmetic, tests its assumptions, examines who bears the consequences, and considers escalation or scope limits. A positive time balance alone does not establish that deployment is acceptable.

Illustrative case study

Fictional case: Brookside Learning considers a tool that prioritizes student support requests. The project team initially focuses on reducing the queue. Its assessment includes staff and people who use the service, revealing that short or incomplete messages sometimes reflect difficulty describing a problem rather than low need.

The team revises the proposed workflow to preserve a route for clarification and human review. It records what remains uncertain and plans to monitor delayed responses and complaints, not just average queue length.

The case illustrates how assessment can change a design before rollout. It does not claim the revised tool is fair, legally compliant, or effective without further evidence from its intended setting.

Common misconceptions and mistakes

An impact assessment is not just an accuracy report. Technical performance matters because it can affect consequences, but the consequences need their own analysis.

It is also not a prediction of every possible future event. Uncertainty should be documented rather than replaced by confident numbers without support.

Another mistake is reporting only an average benefit. A proposal may help many users while imposing serious burdens on a smaller group. A single combined score can conceal that distribution. Finally, completing a template is not the same as implementing the actions it identifies.

Business use

Businesses can use impact assessments to connect investment decisions with operational responsibility. Start while the proposal can still change, and include staff who understand the real workflow alongside people with relevant technical and human expertise.

Keep the output actionable: describe the use, evidence, affected parties, alternatives, unresolved concerns, owners, and review triggers. A clear record helps procurement and leadership distinguish a supported decision from an optimistic assumption. It also provides context for later incident review when an effect differs from what the project expected.

Check your understanding

An AI service saves staff time overall but delays urgent requests for a small group. Can the time-saving calculation settle the deployment decision?

Answer: No. The assessment must examine the delayed requests' severity, distribution, alternatives, and available controls alongside the operational benefit.

Related terms

Harmful bias
Accountability
Incident response
Risk assessment
affected stakeholders
human oversight
impact monitoring
risk management

Learn next

Study stakeholder engagement and risk assessment next. For a proposed AI feature, list who receives benefits, who could bear costs, and which affected people are absent from the project meetings. Identify evidence needed before deciding whether the proposal should proceed.

Sources

NIST, AI Risk Management Framework 1.0, impact and risk-measurement discussion: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf

NIST, AI RMF Playbook, MAP 5.1 and MAP 5.2: https://airc.nist.gov/airmf-resources/playbook/map/

Relevant official passages were read. This is a general AI-governance explanation; the arithmetic and fictional service are original teaching examples, not a legally prescribed assessment method.

Previous: Immutable Data Types Next: Impartial culture