Governance · AI governance and assurance · 06
Impact assessment for high-consequence uses
An impact assessment for high-consequence AI uses examines a specific AI system that makes or shapes decisions about people, safety, money or legal rights, and establishes what could go wrong, for whom, how likely it is, how it would be detected, and what controls reduce it to an acceptable level. It is needed before deploying AI in hiring, credit, healthcare, legal, insurance or safety contexts, when a regulation or standard requires an impact assessment, when a customer asks how an AI-driven decision is governed, or when an existing use has caused a complaint. The assessment produces a documented analysis of purpose, data, affected parties and harms, the controls and human oversight required, residual risk accepted by an accountable owner, and the monitoring that keeps the assessment valid.
Scope
What the review covers.
- Purpose, context and the decisions the system makes or influences
- Affected parties and the harms that could occur
- Data quality, bias, provenance and representativeness
- Performance, reliability, explainability and failure modes
- Controls: human oversight, thresholds, appeal, monitoring
- Residual risk acceptance and review triggers
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Impact assessment report | Structured analysis with findings |
| Control requirements | Oversight, thresholds, appeal and monitoring |
| Risk acceptance record | Signed by the accountable owner |
| Monitoring plan | What is watched and when the assessment is revisited |
Prerequisites
What we need from you.
- Access to the system, its documentation, its data and its owners
- The regulatory and contractual requirements that apply to the use
- An accountable owner authorized to accept residual risk
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is this a legal requirement?
In some jurisdictions and sectors, yes, and ISO/IEC 42001 requires AI system impact assessments. Where not required, it is still the record a regulator asks for after a complaint.
Do you test the model?
Where testing is feasible and in scope, yes. Many assessments rely on documentation, data review and operational testing rather than model internals.
How is this different from a privacy impact assessment?
It overlaps where personal data is involved. The AI assessment covers decision quality, bias and oversight as well. See Data protection impact assessments.