Algorithmic Impact Assessment (AIA)

How to use this document

• What it is for. This is a template to assess, before deploying an AI system and whenever it changes significantly, its effects on people, groups and society: it describes the system and its use, identifies possible benefits and harms, defines measures, rates residual impact and documents the go/no-go decision. It covers the elements that AI and data-protection rules usually require for this kind of assessment; the rules related to this document are listed in the related regulations block.
• What it is not. It does not replace the data protection impact assessment (DPIA) or the fundamental rights impact assessment (FRIA) under the EU AI Act. They are separate documents with different triggers and recipients. The decision box in Section 2 shows which one or ones to run; they can share information, but each is completed and approved separately.
• Who should own it. The AI lead coordinates assessments; the system owner supplies the information and the data protection officer (or the country's equivalent role) is consulted. Enter the function in [RESPONSIBLE FUNCTION].
• Decisions to take first. The type of assessment is set by the system's level under the "AI Risk Classification Matrix": Low, screening record (aid G); Medium, short assessment (aid H), approved by the AI lead; High, this full assessment, approved by [AI COMMITTEE] or management. The rating scale is that of the "AI Risk Management Procedure" (aid A) and the approval deadlines are those of the "AI Governance Operating Model". Decide only whether you add triggers of your own.
• Fields to complete. Complete one assessment per AI system or use case. Replace the bracketed fields and delete sample rows. If the system is Low, complete only the screening record (aid G); if it is Medium, the short assessment (aid H).
• Country variants. This document has no country variants. Use "Related regulatory references" to identify which laws may require an assessment in your case and complete the corresponding row of the decision box.
• Review. Have internal legal or outside counsel review the regulatory classification, the decision box and the conclusion for the highest-impact systems.
• Approval and retention. Have it approved by a person with authority over the system, keep the signed version under version control and link it to the AI system inventory and the risk register.

Algorithmic Impact Assessment (AIA)

Field	Content
Organization	[LEGAL ENTITY NAME]
AI system assessed	[AI SYSTEM]
AI system inventory identifier	[COMPLETE]
System owner	[OWNER]
Function coordinating the assessment	[RESPONSIBLE FUNCTION]
Assessment type	Initial / Significant change / Periodic
Format	Short (Medium level, aid H) / Full (High level)
System level under the classification matrix	Low / Medium / High
Start and close dates	[DATE] / [DATE]
Assessment version	[COMPLETE]
Approved by	[APPROVED BY]

1. Purpose and scope

1.1 This assessment analyzes the foreseeable effects of the AI system named above on people, groups and society over its life cycle, so that [ORGANIZATION NAME] can decide whether to deploy or keep it, under what conditions and with what follow-up.

1.2 It covers the system in its real context of use: the technology, the data, the people who use it, the people it acts on, the process it is part of and reasonably foreseeable misuse.

1.3 This assessment does not replace other assessments required by law. Its relationship with them is determined in Section 2.

2. Decision box: which assessments apply

2.1 Before starting, the assessment team answers these questions and records the result.

Question	Yes / No	If yes
What level does the system have under the "AI Risk Classification Matrix"?	[COMPLETE: Low / Medium / High]	Low: screening record (aid G) and inventory entry. Medium: short assessment (aid H). High: this full AIA.
Does the system process personal data in a way likely to result in a high risk to people (for example, profiling with significant effects, automated decisions, sensitive data, systematic monitoring, children's data or large-scale processing)?	[COMPLETE]	Also run a DPIA under the GDPR (Article 35) or the applicable data protection law.
Does the organization use, in the European Union, a high-risk system listed in Annex III of Regulation (EU) 2024/1689, and is it a public body or a private entity providing public services, or does it use the system to assess the creditworthiness of natural persons or to price life or health insurance?	[COMPLETE]	Also run a FRIA under Article 27 of Regulation (EU) 2024/1689.
Does any applicable sector-specific or local law require its own risk or impact assessment (for example, the CCPA regulations' risk assessment in California or the prior assessment required of public bodies in Peru)?	[COMPLETE]	Also run that assessment in the format the law requires: [COMPLETE].
None of the above?	[COMPLETE]	Complete the screening record (aid G) and file it.

2.2 How the assessments differ:

Aspect	AIA (this document)	DPIA	FRIA
What it protects	People, groups and society against any effect of the system	People's rights and freedoms in relation to the processing of their personal data	Fundamental rights of people affected by a high-risk AI system
What triggers it	Medium level (short assessment) or High level (full assessment) under the "AI Risk Classification Matrix"	Processing of personal data likely to result in high risk	Use of certain high-risk systems by certain deployers
Who leads it	AI lead	DPO or privacy function	Deployer, with legal and compliance
Possible external recipient	Clients and auditors	Data protection authority (prior consultation when residual risk remains high)	Market surveillance authority (notification of results)
Organization's document	This template	Data Protection Impact Assessment (DPIA) for AI	Fundamental Rights Impact Assessment (FRIA)

2.3 When several assessments apply, they are coordinated: the system description (Section 5) and the identification of affected people (Section 6) can be reused, and each assessment cross-refers to the others. The conclusion of this AIA does not presume the conclusion of the DPIA or the FRIA.