A city that wants to use an AI model to flag benefit applications for fraud review would, before launch, write down who the system affects (applicants, caseworkers), what could go wrong (wrongly flagging people, uneven error rates across groups, no way to appeal), how likely and serious each harm is, and what it will do about it: human review of every flag, monitoring error rates, a clear appeal route. The document is then revisited when the model, data or use changes.
The EU AI Act makes one version mandatory. Article 27 requires public bodies, private entities providing public services, and deployers of certain credit-scoring and insurance-pricing systems to carry out a fundamental rights impact assessment before deploying a high-risk AI system. The NIST AI RMF treats impact assessment as a voluntary practice for understanding potential harms in context.
Editorially, the assessment is only as good as what it changes. A useful one names a decision (ship, ship with safeguards, or don’t), an owner, and the monitoring that would show the assessment was wrong; see AI governance for the controls it feeds and AI incident for what happens when a predicted harm occurs.
Sources
- EU AI Act Explorer: Article 27, Fundamental Rights Impact Assessment for High-Risk AI Systems — Requires public bodies, private entities providing public services and deployers of certain credit and insurance systems to assess impacts on fundamental rights before deploying a high-risk system; checked October 24, 2026.
- NIST AI 100-1: AI RMF 1.0 — Describes AI system impact assessment approaches as a way to understand potential impacts or harms within specific contexts; checked October 24, 2026.