An AI impact assessment (AIIA) is a structured evaluation to identify, analyse and mitigate the risks and impact of an AI system. For offices that work with AI, this goes beyond privacy alone: an AI impact assessment also looks at fairness, transparency and the wider consequences for society.
What does AIIA mean?
The abbreviation AIIA stands for AI Impact Assessment. The term comes from international AI governance frameworks, in particular ISO 42001 and the related ISO 42005 standard for AI system impact assessment. The OECD also uses comparable guidelines for responsible AI use.
For many offices in the Netherlands, the term is relatively new, but the underlying idea is not: you look in advance at the harm an AI system could do, before you put it into use.
Why carry out an AI impact assessment?
An AIIA helps you demonstrate that you use AI responsibly. There are three reasons.
First, you show accountability: you deliberately document how you assessed an AI system, instead of having to explain afterwards why you did not. Second, you work on transparency: clients and regulators see that you take risks seriously. Third, you build trust, and that is exactly what offices in knowledge-intensive sectors depend on.
Not every AI system needs the same depth. An AI tool that suggests text for an email needs less scrutiny than an AI system that helps decide on lending or hiring. Make the depth of your AIIA proportionate to the risk.
What do you examine in an AIIA?
An AIIA examines five main points: fairness, bias, explainability, privacy and human oversight.
Fairness is about whether the system treats everyone equally. Unintended disadvantage to certain groups based on historical data falls under bias. Explainability is about whether you can explain why the system gives a particular outcome. Privacy concerns how personal data is processed, even though this partly overlaps with a DPIA. Does a person ultimately stay in control of important decisions? That is the core of human oversight.
A practical example: an accountancy firm uses AI to sort clients into risk profiles. The AIIA then examines whether that sorting is fair, whether you can explain why a client falls into a particular category, and whether an employee can still correct that classification.
AI impact assessment vs DPIA: how do they differ?
An AIIA differs from a DPIA in having a broader scope. A DPIA focuses specifically on privacy risks under the GDPR, whereas an AIIA assesses the full impact of an AI system, covering fairness, explainability and consequences for society as well as privacy.
The two instruments partly overlap. An AI system that processes personal data often calls for both a DPIA and an AIIA. The difference lies in depth: an AIIA is usually more extensive and longer than a DPIA, and assesses the system across the board rather than only through a privacy lens. For a high-risk AI system under the AI Act, from 2 December 2027, the legally required FRIA may apply alongside the voluntary AIIA. That obligation applies to public bodies and private parties providing public services, as well as deployers of systems for creditworthiness and for risk assessment and pricing in life and health insurance (Annex III, point 5(b) and (c)).
How do you start an AIIA?
An AIIA starts with documenting the AI system: what it does, which data it uses and who the stakeholders are (clients, employees, regulators).
Next, you assess each of the five main points from the previous section: fairness, bias, explainability, privacy and human oversight. For each point, you write down which risk you see and which measure you take to limit it.
Keep the scope of your AIIA proportionate to the risk of the system. A text generator for internal memos needs a few paragraphs of assessment; an AI tool that influences client acceptance calls for a more thorough process.
How do you take a first step towards an AIIA?
An inventory maps out which AI tools your organisation already uses and which risk level (low, medium, high) goes with each. Such an inventory is not a full AIIA, but it is a good starting point.
After that inventory, you know exactly which AI applications in your organisation deserve the most attention, and any full AIIA you carry out afterwards will be much more focused. The people who use those tools also need to recognise the risks, which is where AI training for teams fits in.
Frequently asked questions about an AI impact assessment
If you want to set up an AIIA, you can build on existing templates, such as the one the Dutch government has published.
Is there a template for an AI impact assessment?
Yes, the Dutch Ministry of Infrastructure and Water Management has published a public AIIA template, with version 2.0 released at the end of 2024. The template has two parts: part A assesses whether you want to deploy an AI system, and part B covers how it is set up and used. Within that ministry, the AIIA must be completed before a system goes into production, including for a pilot.
Who carries out an AIIA?
You carry out an AIIA with a multidisciplinary group from your organisation, not with one person. For each chapter, the template from the Ministry of Infrastructure and Water Management names roles such as lawyers and privacy specialists alongside data scientists. If the system processes personal data, the template also prescribes a DPIA pre-scan to determine whether a full DPIA is needed.
What is the difference between an AIIA and an IAMA?
The difference between an AIIA and an IAMA lies in the focus. An IAMA (Impact Assessment Mensenrechten en Algoritmes, known in English as FRAIA), developed by Utrecht University, maps the impact of algorithms on human rights in advance and is intended for government organisations. The AIIA template from the Ministry of Infrastructure and Water Management assesses an AI system more broadly. According to that template, you no longer need to complete both, unless you need extra help with assessing fundamental rights.
