AI Impact Assessment: Which Laws Require One, What Each Must Contain, and a Field-by-Field Template

What is an AI impact assessment, and which laws require one?

An AI impact assessment is a documented analysis, made before a system is used and updated as it changes, of who the system could affect, how, how likely and how severe the harm could be, and what the organization will do about it. As of November 2, 2026, the EU AI Act (from December 2, 2027), the GDPR, and California’s CCPA regulations require one for defined uses, and Canada’s Directive on Automated Decision-Making and OMB Memorandum M-25-21 require one for federal government AI. Some US state privacy laws, including Colorado’s and Virginia’s, also require a data protection assessment for profiling that presents a reasonably foreseeable risk of listed harms to consumers; this page does not compare them. Each law sets its own trigger, contents, and recipient, so one document serves several laws only if it carries every field each requires.

What must each law’s assessment contain, and who receives it?

AI impact assessment duties and frameworks, as of November 2, 2026

Law or framework	Who it reaches	When	Contents	Where results go
EU AI Act, Article 27 (fundamental rights impact assessment)	Deployers of Annex III high-risk systems that are bodies governed by public law or private entities providing public services, and deployers of systems that evaluate the creditworthiness of natural persons or establish their credit score, fraud detection excluded (Annex III point 5(b)), or that perform risk assessment and pricing in relation to natural persons in life and health insurance (point 5(c)); critical infrastructure systems (point 2) are excluded	Before deploying; from December 2, 2027, with Article 111(2) setting the rule for systems placed on the market or put into service before then	The deployer’s processes, period and frequency of use, affected persons and groups, specific risks of harm, human oversight, and measures if risks materialise, including internal governance and complaint mechanisms	Results notified to the market surveillance authority with the filled-out AI Office template; an Article 46(1) exemption is possible
GDPR, Article 35 (data protection impact assessment)	Controllers whose processing is likely to result in a high risk to the rights and freedoms of natural persons	Prior to the processing	Description and purposes, necessity and proportionality, risks to data subjects, and measures to address them	Kept by the controller; prior consultation with the supervisory authority under Article 36 where the assessment indicates high risk in the absence of mitigating measures
California CCPA regulations, 11 CCR 7150 to 7157 (risk assessment)	Businesses subject to the CCPA whose processing presents significant risk to consumers’ privacy, including using ADMT for a significant decision or processing personal information to train ADMT for one	Before initiating the processing; by December 31, 2027 for covered processing initiated before January 1, 2026 and continuing after	Nine elements in 7152(a), including specific purpose, data categories, ADMT logic and output, benefits, negative impacts, safeguards, and whether to proceed	Summary information and an attestation to the California Privacy Protection Agency, by April 1, 2028 for 2026 and 2027 assessments; full reports within 30 days on request
Canada, Directive on Automated Decision-Making (Algorithmic Impact Assessment)	Federal institutions subject to the Policy on Service and Digital, for automated decision systems in production used to make administrative decisions about clients	Before production; reviewed on a schedule and when functionality or scope changes	Impact level I to IV, which sets notice, explanation, peer review, and approval requirements	Final results published on the Open Government Portal
OMB Memorandum M-25-21	US federal agencies; AI used as a component of a National Security System is not covered	Before deploying any high-impact AI use case	Purpose and expected benefit, data quality, impacts on privacy, civil rights, and civil liberties, reassessment, costs, independent review, risk acceptance	Documented by the agency, which must be prepared to report implementation of the minimum practices to OMB in periodic accountability reviews, the annual AI use case inventory, or on request
South Korea AI Basic Act, Article 35	Operators providing products or services using high-impact AI	In advance; an effort duty (“shall endeavor”)	Impact on fundamental rights, reflecting AI-vulnerable groups; elements set in Enforcement Decree Article 28	No filing; public bodies planning to use high-impact AI give preferential consideration to assessed products (Article 35(2))
Colorado SB 26-189	No one; the 2024 Act’s impact assessment was repealed	Not applicable	None; notice, adverse-outcome explanation, data correction, and human review duties apply instead from January 1, 2027	Not applicable
NYC Local Law 144 (bias audit, not an impact assessment)	Employers and employment agencies using an automated employment decision tool in the city	No more than one year before use	Selection or scoring rates and impact ratios by sex, race or ethnicity, and intersectional categories	Audit date, summary of results, and the tool’s distribution date, posted on the employment section of the employer’s or agency’s website
NIST AI RMF 1.0, MAP function (voluntary)	Any organization that chooses to use it	Across the lifecycle	Context, categorization, benefits and costs, component risks, and the likelihood and magnitude of each identified impact (MAP 5.1)	No filing
ISO/IEC 42005:2025 (voluntary)	Any organization that develops, provides, or uses AI and chooses to use it	Throughout the lifecycle, per ISO	Guidance on identifying, evaluating, and documenting impacts on individuals, groups, and society	No filing

Who must complete a fundamental rights impact assessment under the EU AI Act?

Article 27 applies to deployers of high-risk systems under Article 6(2), that is, Annex III systems, other than critical infrastructure systems under point 2. It covers bodies governed by public law, private entities providing public services, and deployers of systems under Annex III points 5(b) and 5(c): evaluating the creditworthiness of natural persons or establishing their credit score, except fraud detection, and risk assessment and pricing in relation to natural persons in life and health insurance. The duty sits on the deployer, not the provider. The EU high-risk AI systems guide covers whether a system is in Annex III.

The assessment must consist of (Article 27(1)(a) to (f)):

• a description of the deployer’s processes in which the system will be used in line with its intended purpose
• the period of time within which, and the frequency with which, the system is intended to be used
• the categories of natural persons and groups likely to be affected by its use in the specific context
• the specific risks of harm likely to have an impact on those persons or groups, taking into account the information the provider gives under Article 13
• a description of the implementation of human oversight measures, according to the instructions for use
• the measures to be taken if those risks materialise, including the arrangements for internal governance and complaint mechanisms

Under Article 27(2), the obligation “applies to the first use” of the system. In similar cases the deployer may rely on previously conducted fundamental rights impact assessments or existing impact assessments carried out by the provider, and it must update the information if any element changes or is no longer up to date during use. Once the assessment is done, the deployer must notify the market surveillance authority of its results, submitting the filled-out template as part of the notification. In the case referred to in Article 46(1), where a market surveillance authority has authorised a system by derogation from conformity assessment for exceptional reasons such as public security, deployers may be exempt from that notice (Article 27(3)).

Article 27(5) requires the AI Office to develop a template questionnaire, including through an automated tool. The Commission’s guidelines page, last updated July 31, 2026, lists “Guidelines with a template for the fundamental rights impact assessment” among the guidelines the AI Office is still working on.

Article 27 applies from December 2, 2027 for Annex III systems under amended Article 113(c). For a high-risk system placed on the market or put into service before that date, other than a component of the EU large-scale IT systems listed in Annex X, which Article 111(1) treats separately, Article 111(2) applies the Regulation to its operators only if the system is subject to significant changes in its design from that date, but providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by August 2, 2030.

Article 99(1) requires each Member State to lay down penalties for any infringement of the Regulation by operators. The Article 99(4) fine tier, up to €15 million or, for an undertaking, 3% of total worldwide annual turnover for the preceding financial year, whichever is higher (lower for SMEs and SMCs), lists deployer obligations under Article 26 but not Article 27, so the penalty for an Article 27 breach is set by national rules. The exception is a system under the AI Office’s exclusive competence in Article 75(1), such as a system built on a general-purpose AI model by that model’s own provider, where the deployer is that provider or part of its undertaking: there, Article 75c(4) subjects infringement of any applicable provision to the Article 99(4) fines. Article 99(8) leaves it to each Member State whether, and to what extent, public authorities can be fined.

How does a GDPR data protection impact assessment overlap with Article 27?

Under GDPR Article 35(1), where a type of processing, in particular using new technologies, and taking into account its nature, scope, context, and purposes, is likely to result in a high risk to the rights and freedoms of natural persons, the controller must carry out a data protection impact assessment prior to the processing. Article 35(3)(a) requires one for a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects concerning the person or similarly significantly affect the person. The assessment must contain at least a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures envisaged to address them (Article 35(7)). If it indicates high risk in the absence of mitigating measures, the controller must consult the supervisory authority before processing (Article 36(1)).

The AI Act ties the two together. Article 26(9) tells deployers to use the provider’s Article 13 information to carry out the data protection impact assessment. As amended by Regulation (EU) 2026/1744, Article 27(4) provides that if any Article 27 obligation is already met through a data protection impact assessment, the deployer may include cross-references to the relevant sections of that assessment, or include relevant parts of it, in the fundamental rights impact assessment.

What does California require in an ADMT risk assessment?

The California Privacy Protection Agency’s regulations, effective January 1, 2026, require a business subject to the CCPA to conduct a risk assessment before initiating processing that presents significant risk to consumers’ privacy (11 CCR 7150(a)). The list includes using ADMT for a significant decision concerning a consumer, and processing personal information the business intends to use to train ADMT for a significant decision or to train facial-recognition, emotion-recognition, or other technology that verifies identity or conducts physical or biological identification or profiling (7150(b)).

The assessment must determine whether the risks to consumers’ privacy outweigh the benefits to the consumer, the business, other stakeholders, and the public (7152(a)); its stated goal is restricting or prohibiting the processing if they do (7154). The risk assessment must identify a specific, not generic, purpose; the categories of personal information, including the minimum necessary; operational elements such as collection method, retention, the approximate number of consumers, disclosures, and recipients; for ADMT used for a significant decision, its logic, including assumptions and limitations, and its output and how the business will use it to make the decision; benefits; negative impacts and their sources and causes; safeguards; whether the business will initiate the processing; who provided information; and who reviewed and approved it, including an individual with authority to participate in deciding whether the processing starts (7152(a)(1) to (9)).

A business that makes ADMT trained on personal information available to another business for a significant decision must give it all facts available to the business that are necessary for its own risk assessment (7153). Assessments must be reviewed, and updated as necessary, at least once every three years, and updated after a material change as soon as feasibly possible but no later than 45 calendar days from the change (7155). The California AI laws guide covers the ADMT notice, opt-out, and access duties that apply from January 1, 2027.

Does Colorado still require an AI impact assessment?

Not under its AI law. SB 26-189, signed May 14, 2026, repealed and reenacted the 2024 Colorado AI Act (SB 24-205) before its duties applied. The enacted text of SB 26-189 contains no risk management program, no impact assessment, and no framework-based defense; its duties, which apply to consequential decisions made on or after January 1, 2027, rest on notice, adverse-outcome explanation, data correction, and human review. Colorado’s privacy law is separate: under C.R.S. 6-1-1309, a controller covered by the Colorado Privacy Act must not conduct processing that presents a heightened risk of harm to a consumer, including profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers, without conducting and documenting a data protection assessment, which it must make available to the Attorney General on request. The Colorado SB 26-189 guide sets out each duty and the enforcement limits in X.AI LLC v. Weiser.

Is a NYC Local Law 144 bias audit an AI impact assessment?

No. Local Law 144 bars an employer or employment agency from using an automated employment decision tool to screen candidates or employees for hiring or promotion in the city unless the tool had an independent bias audit no more than one year before use and a summary of the results is posted. The audit tests disparate impact on the EEO-1 Component 1 sex and race or ethnicity categories, using selection or scoring rates and impact ratios, including intersectional categories (Admin. Code 20-870; 6 RCNY 5-300, 5-301). It does not ask what the tool is for, what benefits it brings, or what the employer will do when a risk materializes, and no result fails it. The NYC Local Law 144 guide covers the methods.

What do Canada and the US federal government require for government AI?

Canada’s Treasury Board Directive on Automated Decision-Making applies to any automated decision system in production used to make an administrative decision or a related assessment about a client (section 5.1). Before production, the assistant deputy minister responsible for the program, or another senior official the deputy head names, must complete, approve, and publish the final results of an Algorithmic Impact Assessment in an accessible format on the Open Government Portal (section 6.1.1). The same official must apply the Appendix C requirements the assessment determines (6.1.2) and review, approve, and update the published assessment on a scheduled basis, including when the system’s functionality or scope changes (6.1.3). Appendix B sets four levels, from Level I, “little to no, easily reversible, and brief impacts,” to Level IV, “very high, irreversible and perpetual impacts”. Approval to operate rises from the assistant deputy minister at Levels I and II to the deputy head at Level III and the Treasury Board at Level IV. The Canada AI regulation guide covers the private-sector rules, including Quebec’s privacy impact assessment for information system projects.

OMB Memorandum M-25-21, issued April 3, 2025, requires US federal agencies to complete an AI impact assessment before deploying any high-impact AI use case, meaning AI whose output serves as a principal basis for decisions or actions with legal, material, binding, or significant effect on matters such as civil rights, access to credit, employment, or housing, or human health and safety. It does not cover AI used as a component of a National Security System, elements of the Intelligence Community are not required to apply its minimum practices, and pilot programs that meet its conditions are exempt from them. At a minimum it must address the intended purpose and expected benefit, the quality and appropriateness of the data and model, potential impacts on privacy, civil rights, and civil liberties with planned mitigations, reassessment schedules, related costs, the results of review by an independent reviewer within the agency who was not involved in development, and risk acceptance signed by the individual accepting the risk. A Chief AI Officer may waive one or more minimum practices for a specific covered AI application or component after making a written determination, based on a system-specific and context-specific risk assessment, that fulfilling the requirement would increase risks to safety or rights overall or would create an unacceptable impediment to critical agency operations; each waiver must be recertified annually, and the agency must publicly release a summary of it to the extent consistent with law. The memo binds agencies, not vendors.

Where do the NIST AI RMF, ISO/IEC 42005, and South Korea’s effort duty fit?

NIST AI RMF 1.0 is intended for voluntary use, and its MAP function is where impact assessment sits. MAP 3.1 and 3.2 examine benefits and costs, and MAP 5.1 is the outcome in which the likelihood and magnitude of each identified impact, both potentially beneficial and harmful, are identified and documented. The NIST AI RMF guide maps the full Core.

ISO/IEC 42005:2025, AI system impact assessment, was published May 28, 2025. ISO describes it as guidance for organizations conducting AI system impact assessments and says it complements ISO/IEC 42001, the certifiable management system standard compared in the AI governance frameworks guide.

South Korea sits between voluntary and binding: under Article 35(1) of its AI Basic Act, an operator providing products or services using high-impact AI “shall endeavor” to assess the impact on fundamental rights in advance.

AI impact assessment template: how do the laws’ required contents line up?

This outline merges the legal contents above into one record, each field tagged with the provisions it comes from. The tags do not show whether a given law reaches a given system; the sections above set out each law’s scope. The outline condenses each law’s list and does not repeat every element, so check each applicable provision in full. For example, California 7152(a)(3)(C) (how the business interacts with the consumers) and OMB M-25-21 item B (whether the data will be released as an open government data asset) are not shown, Canada’s assessment is completed through the Algorithmic Impact Assessment tool that TBS maintains (Directive section 7.2), and Korea’s elements are set in Enforcement Decree Article 28.

1. System, version, and owner. Needed to apply update triggers. (EU 27(2); California 7155; Canada 6.1.3)
2. Specific purpose and the processes the system runs in. (EU 27(1)(a); GDPR 35(7)(a); California 7152(a)(1); OMB M-25-21 A; NIST MAP 1.1)
3. Period and frequency of use. (EU 27(1)(b))
4. Data: categories, the minimum necessary, sources, retention, and fitness for purpose. (California 7152(a)(2) and (3); OMB M-25-21 B)
5. Logic and output, with assumptions and limitations, and how the output is used to make the decision. (California 7152(a)(3)(G); Canada Appendix C explanation)
6. Affected persons and groups, their approximate number, and vulnerable groups. (EU 27(1)(c); California 7152(a)(3)(D); Korea Article 35(1))
7. Necessity and proportionality. (GDPR 35(7)(b))
8. Benefits and costs. (California 7152(a)(4); OMB M-25-21 A and E; NIST MAP 3.1 and 3.2)
9. Risks of harm, with sources, causes, likelihood, and magnitude. (EU 27(1)(d); GDPR 35(7)(c); California 7152(a)(5); OMB M-25-21 C; NIST MAP 5.1)
10. Human oversight. (EU 27(1)(e))
11. Safeguards, response if a risk materializes, internal governance, and complaints. (EU 27(1)(f); GDPR 35(7)(d); California 7152(a)(6); OMB M-25-21 C)
12. Disclosures to affected people and data recipients. (California 7152(a)(3)(E) and (F); Canada Appendix C notice)
13. Decision to proceed, contributors, independent review, and approval with names, positions, date, and signature. (California 7152(a)(7) to (9); OMB M-25-21 F and G)
14. Reassessment schedule, filing, and prior consultation. (EU 27(2) and (3); California 7155 and 7157; Canada 6.1.1 and 6.1.3; OMB M-25-21 D; GDPR 36)

How do you run an AI impact assessment?

• List every AI system that informs a decision about people, and record which law in the table reaches each one
• Check each system and your organization against the Article 27 deployer categories set out above
• Ask each provider for its Article 13 instructions for use, any impact assessment it has done, and, for California, the facts 7153 requires
• Complete one record that carries every element each applicable law lists, using the fourteen fields above as an outline
• Where a GDPR data protection impact assessment already meets an Article 27 obligation, cross-reference or include its relevant parts (Article 27(4))
• Calendar California’s December 31, 2027 deadline for processing under way before January 1, 2026, the April 1, 2028 submission for 2026 and 2027 assessments, the 45-day update after a material change, and the three-year review
• Watch for the AI Office template and your market surveillance authority’s notification process before December 2, 2027
• Treat a Local Law 144 bias audit or a NIST or ISO exercise as meeting a legal assessment duty only if the record carries every element that law requires; California allows reuse of an assessment prepared for another purpose on that condition (7156(b))

The AI governance frameworks guide compares ISO/IEC 42001 and the NIST AI RMF. The EU high-risk AI systems, California AI laws, and Canada AI regulation guides cover the rules around each assessment.

This page is general information as of November 2, 2026, not legal advice; confirm current text with counsel or the regulator before relying on it.

By industry: all 8 industry pages