Impact assessment result
0
Residual planning risk
Assessment snapshot
Impact matrix
| Impact domain | Severity | Likelihood | Inherent rating |
|---|
Free governance tool · 2026 edition
Understand who an AI system could affect before you deploy it
Map plausible impacts, test 29 lifecycle controls, expose blocking gaps, and generate an accountable mitigation and monitoring brief.
- 8 impact domains
- 29 control questions
- Severity × likelihood matrix
- Decision gates
- JSON, CSV, and print report
Transparent methodology
Impact first, then controls and evidence
The tool separates plausible inherent impact from control maturity and reviewed evidence. A serious rights, safety, privacy, or human-oversight gap can pause the decision even when the average score looks acceptable.
People & rights
Stakeholders, participation, notice, explanation, accessibility, challenge, and remedy.
Data & privacy
Necessity, purpose, minimization, provenance, quality, retention, rights, and assessment.
Quality & fairness
Fitness, representative tests, subgroup outcomes, failure analysis, reproducibility, and drift.
Safety & security
Threats, injection, access, output handling, incidents, resilience, fallback, and recovery.
Oversight & lifecycle
Ownership, human authority, training, monitoring, change, documentation, and decommissioning.
How the calculation works
- Impact rating: severity (0–4) × likelihood (1–4) for each of eight domains.
- Inherent impact: the strongest plausible impact domains plus contextual uplift for reach, authority, reversibility, data, stage, and affected groups.
- Control maturity: Verified = 100, Partial = 60, Planned = 30, Unknown = 10, Missing = 0, weighted by importance.
- Residual planning risk: inherent impact reduced by control maturity, then adjusted for evidence coverage and critical gates.
- Scope: scores support prioritization and accountable discussion; they are not probabilities, certifications, or legal conclusions.
Need the complete step-by-step process?
Use the practical guide to define scope, involve affected stakeholders, map benefits and harms, rate severity and likelihood, verify controls, document mitigations, and set monitoring and reassessment triggers.
Read the AI Impact Assessment GuideFAQ
AI impact assessment questions
No. It is a general planning aid and does not establish compliance with any law or replace a required AIA, DPIA, FRIA, safety assessment, legal review, consultation, audit, or accountable approval.
Inherent risk is the plausible impact before relying on controls. Residual planning risk is the remaining profile after applying the entered control maturity and evidence coverage.
Participation should match the context and may include affected people, business owners, domain specialists, privacy, security, legal, compliance, accessibility, procurement, technical teams, frontline users, and independent reviewers.
Update it before deployment and after material changes to purpose, data, model, users, affected groups, authority, integrations, performance, vendor, controls, law, incidents, or operating conditions.
No. The score supports discussion and prioritization. Production authorization remains with the organization’s accountable decision-makers and applicable specialist review.