Impact Assessment Summary Register

How to use this document

• What it is for. This is a base register that brings together, in a single view, the summary of every impact assessment the organization performs on its AI systems: AI impact assessments, data protection impact assessments (DPIAs), fundamental rights impact assessments and similar assessments. It lets leadership, audit or an authority see what was assessed, what was decided, under which conditions and when it is due for review, without opening each file.
• Who should own it. Usually the AI lead or the data protection officer (or the country's equivalent role), supported by the [AI COMMITTEE]. Enter the function in [RESPONSIBLE FUNCTION] and the person who maintains the register in [OWNER].
• Decisions to take first. Decide which types of assessment the register covers (Section 3), who may consult the register (Section 9) and where full assessment files are kept.
• Fields to complete. Complete one summary sheet (Section 7) for each assessment closed or updated and add a row to the consolidated register (Section 6). Replace the bracketed text; keep [OPTIONAL] rows only if they apply.
• Country variants. This document has no country variants. Each jurisdiction uses its own names and deadlines for these assessments (for example DPIA, RIPD or privacy impact study); use "Related regulatory references" to identify which apply and add the local name in the "Type of assessment" column.
• Review. Ask the data protection officer or counsel to confirm which assessments the law requires in your case and whether any must be notified to or discussed with an authority.
• Approval and use. Have the format approved by the [AI COMMITTEE] or management, record the approval in "Version history" and present the consolidated register at each periodic AI risk review.

Impact Assessment Summary Register

Field	Value
Organization	[LEGAL ENTITY NAME]
Function that owns the register	[RESPONSIBLE FUNCTION]
Register owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Location of full assessment files	[COMPLETE]
Contact	[AI GOVERNANCE EMAIL]; for data protection assessments, [PRIVACY EMAIL]

1. Purpose and scope

1.1 [ORGANIZATION NAME] keeps this register to record, in summary form, all impact assessments carried out on AI systems it develops, acquires or uses, the decisions taken based on them and the fulfillment of the conditions imposed.

1.2 The register does not replace the full file for each assessment. Each summary refers to the file, which is kept with its methodology, annexes and signatures.

1.3 The register covers the AI systems listed in the organization's AI system inventory, whether built in-house or supplied by third parties.

2. When a summary is recorded

A summary is created or updated when:

a) a new impact assessment is closed, with any outcome, including a decision not to proceed with the system;
b) an assessment is updated because of a significant change in the system, model, data, purpose, affected people or vendor;
c) an assessment is updated after an incident, a relevant complaint or an audit finding;
d) the applicable law changes in a way that affects the conclusion;
e) the periodic review date set in the assessment itself is reached.

The summary is recorded within [COMPLETE: business days] of the assessment being closed or updated.