AI System Impact Assessment
Produce a documented impact assessment for an AI system — the artifact an ISO/IEC 42005 process, an EU AI Act Article 27 fundamental-rights impact assessment (FRIA) or a GDPR Article 35 DPIA is built to create. Describe the system and who it affects, build a harm register rated by likelihood × severity across nine dimensions — safety, fundamental rights, fairness, privacy, transparency, autonomy, economic, societal and environmental — record the mitigations and residual risk, the human-oversight and monitoring arrangements, and a go / no-go decision. The NIST AI RMF (with the AI 600-1 generative profile) frames the whole thing. Everything runs in your browser, nothing is uploaded, and the exact assessment is shareable by permalink and exportable to Markdown or CSV.
Work through the register, then record a go / no-go decision below.
1. System purpose & context
What the AI system is for, how and where it is used, and where it sits in its life cycle. (ISO/IEC 42005 begins here.)
2. Affected individuals & groups
Name who the system affects, with particular attention to vulnerable groups — a core step of both ISO/IEC 42005 and the EU AI Act FRIA.
3. Potential benefits
Record the intended benefits to balance against the harms — an impact assessment weighs both.
4. Harm register
For each potential harm, pick a dimension, say who it falls on, rate inherent likelihood × severity, record the mitigation, then re-rate the residual risk. Nine dimensions span individual, group, societal and environmental harm.
5. Human oversight
Meaningful oversight is a requirement in its own right (EU AI Act Art.14) and a mitigation for most harms above.
A named human role can understand the system’s outputs well enough to oversee them, and can intervene, override or halt the system.
EU AI Act Art.14Oversight roles have the authority, competence and time to act on what they see — oversight is real, not nominal "human-in-the-loop" on paper.
EU AI Act Art.14Low-confidence, out-of-distribution or high-stakes cases are routed to a human before they take effect.
NIST AI RMF MANAGEAffected people are told AI is involved and have a meaningful way to question or contest a decision.
ISO/IEC 42005A safe fallback or default state exists if the system fails, is disabled or is taken offline.
NIST AI RMF MANAGEPerformance, errors and impacts are monitored in production on a defined cadence, with thresholds that trigger review or rollback.
NIST AI RMF MEASURE6. Monitoring plan
How impacts are tracked after go-live: metrics, cadence, thresholds that trigger review or rollback, and who owns it (NIST AI RMF MEASURE / MANAGE; ISO/IEC 42005 treats impact assessment as ongoing).
7. Decision
Record the go / no-go outcome of this assessment and the rationale.
Which assessment do I need?
A short orientation only. For a detailed EU AI Act classification, use the EU AI Act classifier; this just points at the right assessment artifact.
Does the system process personal data in a way that is likely high-risk — large-scale or systematic monitoring, special-category data, or automated decisions with legal or similarly significant effects?
Are you a DEPLOYER of a high-risk AI system in an EU AI Act Article 27 category — a public body, a private operator of public services, or a specified creditworthiness or life/health-insurance use?
Do you want a repeatable, auditable way to document the system’s potential consequences to individuals, groups and society, regardless of a specific legal trigger?
What each standard covers
A process for identifying and documenting the potential consequences of an AI system to individuals, groups of individuals and society, across the system life cycle.
When: Applicable to any organisation that wants a repeatable, auditable way to assess and record AI impacts — no specific legal trigger required.
A deployer-side assessment of the impact on fundamental rights that the use of a high-risk AI system may produce, including affected persons, risks of harm and human-oversight measures.
When: Required for certain deployers of high-risk AI systems — notably bodies governed by public law, private operators providing public services, and specified creditworthiness and life/health-insurance uses.
An assessment of the impact of processing operations on the protection of personal data, where a type of processing is likely to result in a high risk to the rights and freedoms of data subjects.
When: Required where processing is likely high-risk — e.g. systematic and extensive automated evaluation with legal/significant effects, large-scale special-category processing, or large-scale systematic monitoring of a public area.
A voluntary framework organised around four functions — GOVERN, MAP, MEASURE and MANAGE — for managing risks to individuals, organisations and society across the AI life cycle; the 600-1 profile overlays generative-AI-specific risks.
When: Applicable to any AI system as an overarching risk-management frame; often used alongside a statutory DPIA or FRIA rather than instead of one.
Educational template, not legal advice. This generator is organised around ISO/IEC 42005, the EU AI Act Article 27 FRIA, GDPR Article 35 DPIA and the NIST AI RMF, referenced by name only — it quotes no statutory text and performs no classification. A statutory DPIA or FRIA may carry specific legal requirements; confirm with qualified counsel. The tool runs entirely in your browser, performs no scan and uploads nothing — your assessment lives only in the shareable link you choose to copy and in any file you export.
What this generator produces
- A free, 100% in-browser generator for an AI SYSTEM IMPACT ASSESSMENT: document a system’s purpose and context, the people it affects, the benefits, and a register of potential harms rated by likelihood × severity — then export the record.
- Harms are assessed across nine dimensions — safety, fundamental rights, discrimination/fairness, privacy, transparency, autonomy, economic, societal/democratic and environmental — spanning harm to individuals, groups, society and the environment.
- Each harm gets an inherent rating, a mitigation, and a residual rating, plotted on a 5×5 risk matrix. Human-oversight and monitoring sections and a go / no-go decision complete the record.
- Structured around ISO/IEC 42005, the EU AI Act Article 27 FRIA, GDPR Article 35 DPIA and the NIST AI RMF (GOVERN/MAP/MEASURE/MANAGE, with the AI 600-1 generative profile), referenced by name only. A short router points you at the right one.
- Educational template, not legal advice — a statutory DPIA or FRIA may carry specific legal requirements, so confirm with counsel. Nothing is uploaded; export to Markdown or CSV and share the exact assessment with a base64url permalink.
An impact assessment is a record, not a verdict
An AI system impact assessment is a documented, repeatable analysis of what a system could do to the people and communities it touches — the subject of ISO/IEC 42005:2024, which treats it as a process to identify and record potential consequences to individuals, groups and society across the life cycle. The same substance underlies the EU AI Act's Article 27 FRIA for certain deployers of high-risk systems and the GDPR's Article 35 DPIA where processing is likely to be high-risk to data subjects. This tool is built to produce that record: a rated harm register, the mitigations and residual risk, the oversight and monitoring arrangements, and a decision — all exportable so it can be kept as the assessment of record.
The nine harm dimensions and the likelihood × severity matrix are a standard risk-assessment convention, shown openly so you can adapt them to your own risk model; the point is a structured, defensible analysis, not a number. The NIST AI Risk Management Framework — GOVERN, MAP, MEASURE and MANAGE, with the AI 600-1 Generative AI Profile as an overlay for generative systems — provides the overarching frame. The frameworks are named for orientation only; this is an educational template, not legal advice, and a statutory DPIA or FRIA may carry specific legal requirements you should confirm with counsel.
Frequently asked questions
What is an AI system impact assessment?
It is a structured process for identifying and documenting the potential consequences of an AI system to individuals, groups and society, across the system life cycle — the subject of ISO/IEC 42005. You describe the system and its context, name who it affects (with attention to vulnerable groups), weigh the benefits, and build a register of potential harms rated by likelihood and severity, with mitigations and a residual rating. This tool produces that record as an exportable artifact.
How is this different from the EU AI Act classifier tool?
The classifier helps you work out whether a system is prohibited, high-risk, limited-risk or minimal-risk under the EU AI Act. This tool is for the impact-assessment artifact itself — the documented analysis of harms, mitigations, oversight and decision. They are complementary: classify first to learn which obligations apply (including whether an Article 27 FRIA is required), then use this to produce the assessment. The short router here only points you at the right assessment; it does not perform the legal classification.
Which standards and frameworks does it draw on?
Four public frameworks, referenced by name only: ISO/IEC 42005:2024 (AI system impact assessment), EU AI Act Article 27 (the fundamental-rights impact assessment, FRIA, for certain deployers of high-risk systems), GDPR Article 35 (the data protection impact assessment, DPIA, where processing is likely high-risk to data subjects), and the NIST AI Risk Management Framework with its AI 600-1 Generative AI Profile as an overlay. It quotes no statutory text and invents no figures; the question wording is PlayCISO’s own plain-language paraphrase.
How does the likelihood × severity rating work?
Each harm is rated on a 1–5 likelihood scale and a 1–5 severity scale; the product is a risk score from 1 to 25, banded Low (1–4), Moderate (5–9), High (10–15) and Critical (16–25) on a conventional 5×5 matrix. You rate the inherent risk first, record the mitigation, then re-rate the residual risk that remains after the mitigation. The register is ranked by residual risk so the most serious remaining harms are at the top. The scales are a standard risk-matrix convention, not a measurement or prediction.
Is this legal advice, and does it replace a statutory DPIA or FRIA?
No. It is an educational template for structuring an assessment, not legal advice, and it does not itself satisfy a legal requirement. A statutory GDPR Article 35 DPIA or EU AI Act Article 27 FRIA may carry specific legal requirements — consultation steps, mandatory content, supervisory-authority involvement — so confirm the requirements that apply to you with qualified counsel or your data protection officer. The artifact this tool produces can hold much of the substantive content, but treat it as input to that process, not a substitute for it.
Does it send my assessment anywhere?
No. The generator runs entirely in your browser. It performs no scan and uploads nothing. Your assessment lives only in the shareable permalink you choose to copy — your answers are encoded in the URL in base64url — and in any Markdown or CSV file you export yourself.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.