Learn AI /Responsible AI, Human Rights and Safety /Impact assessment
Impact assessment
- Intermediate
- Responsible AI, Human Rights and Safety
- Policy officers
- Human rights practitioners
- Programme & data teams
Also called: algorithmic impact assessment, AIA, HRIA.
Back to the milestone you came from
In five seconds
What it is
A structured review used before or during AI use to identify who could be affected, what harms or rights risks may arise, and what controls or human decisions are needed.
In plain words
It is a structured way to check who an AI tool might help or harm before using it, and to decide what safeguards or human review are needed.
An everyday example
Before booking a school trip, an organiser checks who is going, whether the venue is accessible, what travel or safety problems might arise, who needs additional support and which adult is responsible for each decision. Finding a risk does not always cancel the trip. It may require a different route, extra supervision or another venue. If those safeguards cannot be provided, the booking should not proceed.
A shipment is usually a fixed set of boxes, but AI systems can change behaviour when data, users, or context changes. Also, many AI harms are not visible like damaged cargo. They can be indirect, delayed, or unevenly distributed across groups, so the assessment needs evidence, consultation, and follow-up, not just a one-time checklist.
Remember thisAn impact assessment records who may be affected, which harms are foreseeable, what controls are required and which decisions must remain subject to human judgement and accountability.
This term is contested
The broad idea is not disputed, but the exact scope, required steps, and the boundary between AIA, HRIA, audit, and broader due diligence vary across organisations, laws, and sectors.
Understand it
Understand it
Why it matters
Without an impact assessment, people may focus on whether a system works technically and miss whether it is appropriate, lawful, fair, safe, or accountable in practice. For non-specialists, this matters because many AI tools affect real decisions about access, priority, risk, eligibility, speech, or services. A structured assessment makes trade-offs visible early, before harm is scaled. It also helps organisations ask a basic governance question: should this system be used at all, and if so under what limits, evidence, and human oversight?
How an impact assessment moves from proposal to safeguards
Show the ordered process from describing an AI use case to deciding safeguards, accountability, and whether the system should proceed.
01
1. Describe the use case
State the purpose, users, data, outputs, and the decision the system will support or influence.
Draw a box labelled 'Use case' with small icons for form, database, and output report.
02
2. Identify who may be affected
List direct users and people affected indirectly, including groups that may face barriers, exclusion, or unequal errors.
Draw a second box with person icons in varied groups connected to the first box.
03
3. Analyse risks and rights impacts
Check for privacy, discrimination, safety, accessibility, security, and automation-bias risks, and note severity and likelihood.
Draw a third box with a risk matrix symbol and tags for privacy, fairness, safety, accessibility, and security.
04
4. Set controls and human roles
Choose mitigations such as data limits, testing, escalation paths, appeal routes, human review, or narrowing the system's scope.
Draw a fourth box with shield, eye, and human-review icons connected from the risk box.
05
5. Decide, document, and revisit
Record the decision, owners, conditions for use, and when reassessment is required if the model, data, or context changes.
Draw a fifth box with a signed document and circular review arrow.
A left-to-right step diagram with five boxes. Read from the proposed AI use case to the final decision. Each box adds one layer: describe the system, identify affected people and rights, rate risks, choose controls, then record and review the decision.
On hover or tap, each step reveals example questions such as 'Who could be harmed?' and 'Should a human make the final decision?'
Describe this without the diagram
This diagram shows five ordered steps in an impact assessment. First, describe the AI use case: its purpose, users, data, and outputs. Second, identify all affected people, including those affected indirectly and those who may face exclusion. Third, analyse risks such as privacy loss, discrimination, safety issues, accessibility barriers, security weaknesses, and over-reliance on automation. Fourth, choose controls like limiting data use, adding testing, requiring human review, or narrowing the task. Fifth, document the decision, assign owners, and plan to review again when the system or context changes.
With reduced motion: A static five-step horizontal diagram with all labels and example questions visible at once, without animation or hover effects.
An impact assessment is a structured check before, and sometimes during, the use of an AI system. It asks practical questions: what the system will do, who may be affected, what data it uses, what could go wrong, and who is accountable if harm occurs. The input is usually a description of the system, its purpose, its users, the data, and the context where it will be used.
Then people examine the likely effects. They look for risks such as discrimination, privacy loss, exclusion, safety problems, over-reliance on automation, weak security, or barriers for people with disabilities. They also check whether some decisions should stay with a human, or need stronger review before action is taken.
The output is not just a score. It is usually a record of risks, affected groups, evidence, mitigation steps, owners, and a decision such as proceed, change the design, limit the use, add human oversight, or do not deploy. Good assessments are updated when the system, data, or use case changes.
These related terms overlap but are not identical. An algorithmic impact assessment, or AIA, usually focuses on risks from an automated or algorithmic system in a specific use case. A human rights impact assessment, or HRIA, looks more broadly at impacts on human rights and may cover AI or non-AI activities. Some organisations combine them, but that does not make them interchangeable in every setting.
How “Planning a school trip before booking” maps onto the real thing
| In the story | In the AI system |
|---|---|
| The manifest and labels | The system description, data sources, and intended purpose |
| Checking for fragile or restricted items | Identifying groups, rights, safety, privacy, and fairness risks |
| Authorised sign-off | Clear accountability and approval before deployment |
| Manual inspection for risky items | Human oversight or keeping some decisions with humans |
A worked example
Before a chatbot concept note goes for clearance, a programme officer in a regional bureau completes an impact assessment of its proposed role in answering public questions from published guidance.
Starting from: Proposed purpose, intended users, approved source documents, supported languages, sample outputs, accessibility requirements, escalation routes and the staff member accountable for the service.
- The officer maps the decision pathway. The chatbot may retrieve and summarise published guidance, but it may not determine eligibility, make commitments or replace the responsible focal point.
- The assessment identifies people who could be affected, including users with limited digital access, users relying on assistive technology and those asking questions in languages for which testing is limited.
- Test prompts reveal that the chatbot can present outdated guidance confidently and can omit qualifications when a question is ambiguous. The assessment records risks of exclusion, misinformation and automation bias.
- Controls are added: a restricted source set, visible source links, accessibility and language testing, referral to a staff member, output monitoring and immediate suspension when material errors are detected.
Result: Clearance is conditional on those controls being in place. The chatbot remains an information aid, staff retain responsibility for substantive advice, and the assessment must be reopened if the sources, model, users or decision pathway change.
In a United Nations workplace
In an evaluation office, a desk officer is preparing talking points for informals on a proposed AI tool that would code interview notes and suggest themes for a synthesis report. Before close of business, the front office asks to see the impact assessment, not merely the vendor slides.
The assessment documents the tool’s purpose, data sources, users, outputs and place in the evaluation process. It considers whose evidence might be misclassified or overlooked, whether recurring themes could be mistaken for findings, and which coding and drafting decisions must remain with evaluators.
Before you try thisInterview notes may contain personal, confidential or protection-sensitive information. They must not be entered into any tool that has not been approved for such material. The assessment should specify permitted data, access controls, retention, human review and the authority to pause use if safeguards fail.
Where you may hear it
- At an ICT governance board reviewing a proposed use case
- During clearance of terms of reference for an AI-enabled service
- At a vendor demonstration in a procurement meeting
- In a project review before an AI tool moves from testing to deployment
Avoid confusion
Avoid confusion
Often confused with
Human rights due diligence
An ongoing process to identify rights harms linked to an organisation’s actions or AI systems, address them, and account for the response.
AI audit and assurance
A structured check of how an AI system is governed, tested and used, producing evidence-based confidence that stated requirements are met and risks are controlled.
Fairness
Designing and checking AI systems so they do not produce avoidable, unjust differences in how people or groups are treated or affected.
Explainability
Explainability means being able to show, in human-usable terms, why an AI system produced a particular output or pattern of outputs.
Common misconceptions
Common misconception: An impact assessment is just a form to complete after the system is already chosen.
Correction: A useful assessment starts early enough to change the design, narrow the use case, add safeguards, or stop the project. If it happens only at the end, it often becomes paperwork rather than a decision tool.
Common misconception: AIA and HRIA are the same thing.
Correction: They overlap, but they often have different scope. An AIA usually centres on an algorithmic system in a defined context. An HRIA looks at impacts on human rights more broadly and may include AI, business operations, supply chains, and remedy. Some organisations combine them, but the names signal different starting points.
Common misconception: If accuracy is high, the impact assessment will be positive.
Correction: High accuracy does not settle questions about discrimination, privacy, accessibility, legal basis, accountability, or whether the task should be automated. A system can perform well on average and still create serious harm for particular groups or in high-stakes cases.
Common misconception: Once the assessment is done, the risk is handled.
Correction: Risks can change when the model, data, user behaviour, or operating context changes. Good practice includes monitoring, incident response, and reassessment, not just a one-time approval.
Quick check
Which statement best captures the role of an impact assessment for AI?
The main purpose is structured risk and accountability review in context: affected people, possible harms, rights impacts, and controls. It does not guarantee compliance, and it does not remove the need for monitoring after deployment.
Go deeper
Go deeper
The simple version
It is a structured way to check who an AI tool might help or harm before using it, and to decide what safeguards or human review are needed.
The technical version
An impact assessment is a documented governance process for evaluating a proposed or deployed AI use case against risk, rights, and accountability criteria. Typical inputs include the system purpose, intended users, data sources, model outputs, deployment context, affected populations, and decision pathways. The assessment then analyses foreseeable impacts such as discrimination, privacy intrusion, security exposure, accessibility barriers, safety risks, due process concerns, and automation bias. It often rates severity and likelihood, identifies legal or policy obligations, assigns risk owners, and specifies mitigations such as data minimisation, restricted scope, testing, contestability, logging, monitoring, human oversight, or non-deployment. An algorithmic impact assessment usually focuses on impacts arising from an automated or algorithmic system in context. A human rights impact assessment focuses on impacts on recognised human rights and may extend beyond the algorithm itself to broader organisational practices and remedy.
Reviewed external resources
Primary sourceRecommendation on the Ethics of Artificial Intelligence (opens in a new tab)UNESCO
A formal international policy text that helps readers see how impact assessment fits into AI ethics governance, especially in public-sector and institutional settings.
Intermediatelink checked 2026-07-31
Primary sourceB-Tech Project (opens in a new tab)UN Human Rights Office (OHCHR)
Practical human rights guidance for technology and business contexts, useful for policy, human-rights, and programme readers who need a rights-based lens.
Intermediatelink checked 2026-07-31
EncyclopaediaImpact assessment (opens in a new tab)Wikipedia
A broad starting point on impact assessment as a general idea, useful for readers who want basic background before focusing on AI-specific uses.
Intermediatelink checked 2026-07-31
VideoVideo explanations: Impact assessment (opens in a new tab)YouTube search
A search results page with many video explanations, useful for readers who learn best by listening or comparing several introductory presentations.
search results, not one pagelink checked 2026-07-31
DiscussionCommunity discussion: Impact assessment (opens in a new tab)Reddit search
A search results page with informal community discussion, useful for seeing common questions, confusions, and practitioner experiences, but not as an authoritative source.
search results, not one pagelink checked 2026-07-31
Where this came from
Drafted with a language model through an offline pipeline, checked against this site's schema, and every external link above fetched to see whether it answers. Treat it as a starting point and check anything that matters against the primary sources. How this site is built and what that means.
The one thing to remember
An impact assessment records who may be affected, which harms are foreseeable, what controls are required and which decisions must remain subject to human judgement and accountability.