AI Impact Assessment

You help the organisation govern AI responsibly and produce ISO 42001-style evidence:

• an AI system inventory
• AI risk assessments, which look at risk to the organisation
• AI system impact assessments, which look at effects on individuals, groups and society (ISO 42001 6.1.4 and A.5)

Read references/grc-workspace.md and references/iso42001.md first.

Modes

• inventory: build or update grc/risks/ai-inventory.csv, covering product AI features and AI tools staff use.
• assess: a full impact and risk assessment for one AI system or feature.
• screen: a quick triage (10 minutes) to decide whether a full assessment or a GDPR DPIA is needed.

Context

Read grc/context/company-profile.md, especially section 5 (AI). Establish the organisation's role for each system: provider, developer, or user/customer of third-party AI.

Inventory fields

ai_system_id, name, description, intended_purpose, role (provider/developer/user), model_or_vendor, deployment (product/internal), users, affected_parties, personal_data (y/n), automated_decisions (y/n), human_oversight, risk_tier (low/medium/high), assessment_status, owner, last_reviewed

Screening questions (screen mode)

1. Does it process personal data? If yes, consider a DPIA (use the dpia skill).
2. Does it make or materially support decisions about people (hiring, credit, access to services, performance)? If yes, it's high impact, and GDPR automated decision-making rules need checking (EU Art. 22; UK Arts. 22A–22D).
3. Is its output shown to customers or the public without human review?
4. Could failure, bias or misuse cause harm to individuals, groups or society?
5. Is it in a regulated domain, or could it fall into a high-risk category under the EU AI Act? If so, flag it for legal review.
6. Who supplies the model, and what do their terms say about data use, retention and training?

Two or more "yes" answers, or "yes" to Q2, means you run a full assessment.

Assess workflow

1. Describe the system: its purpose, intended use and foreseeable misuse, users, affected parties, data flows (inputs, training or fine-tuning data, outputs), model and vendor, and the human oversight points.

2. Impact assessment. For each affected party, assess potential effects across:

   • fairness and bias
   • transparency and explainability
   • privacy
   • safety and wellbeing
   • security (prompt injection, data leakage, model abuse)
   • accountability and contestability
   • reliability and accuracy
   • environmental impact

   Rate severity and likelihood using references/risk-methodology.md, adapting the "Impact" table to harm to people.

3. AI risk assessment. Capture the organisational risks: legal and regulatory, contractual, reputational, supplier dependency, data leakage through prompts, IP, hallucination liability.

4. Controls. Map proposed treatments to ISO 42001 Annex A, e.g.:

   • A.6.2.4 verification and validation
   • A.6.2.6 operation and monitoring
   • A.8.2 user information
   • A.9 responsible use
   • A.10.3 suppliers

   Plus GDPR or ISO 27001 refs where they're relevant.

5. Add the material AI risks to grc/risks/risk-register.csv (category ai). If it doesn't exist, offer to create it via the risk-register conventions.

Outputs

• grc/risks/ai-inventory.csv
• grc/risks/ai-impact-assessments/<system-slug>-YYYY-MM-DD.md, built from assets/ai-impact-assessment-template.md
• Risk register rows (category ai)
• A run log in grc/runs/

Guardrails

• Not legal advice. EU AI Act classification must be confirmed by legal counsel.
• Don't overstate risk for low-stakes internal tooling. Proportionality matters.
• Assessment conclusions and residual risk acceptance need human approval.

References

• references/grc-workspace.md
• references/iso42001.md
• references/gdpr.md
• references/risk-methodology.md