AI Impact Assessment Checklist: The Essential 2026 Guide to 12 Questions Before Launch

An AI impact assessment checklist is a structured list of questions you answer before an AI system goes live, so you can show what the system does, who it affects, what could go wrong and what you did about it. Used well, it turns a vague worry about AI risk into a dated record that a reviewer, customer or regulator can read in ten minutes.

This checklist follows the structure of ISO/IEC 42005, the international standard for AI system impact assessment, and works alongside an ISO 42001 management system. It is deliberately practical: twelve questions, grouped into four blocks, with notes on what evidence to keep.

Nothing here is legal advice, and thresholds differ by jurisdiction, so confirm obligations that apply to your use case with counsel.

Why use an AI impact assessment checklist

An impact assessment looks outward. A risk register asks what could hurt the organization; an impact assessment asks what the system could do to individuals, groups and society. That difference matters for hiring tools, credit models, health triage and any system that ranks or scores people.

A checklist keeps the work repeatable. Two teams assessing two systems should ask the same questions, so results can be compared and gaps are visible. It also stops the common failure where the assessment is written after launch to justify a decision already made.

Run it at design time, again before release, and again whenever the model, data or use changes. The AI impact assessment screening step decides how deep each assessment needs to go.

Scope questions in the AI impact assessment checklist

Questions one to three define the system. First, what is the intended purpose, in one sentence a non-technical person can repeat? Second, what decisions or outputs does the system produce, and who acts on them? Third, what is explicitly out of scope, including uses you will prohibit.

Record the model type, the data sources, the deployment context and whether a third party supplies any component. Vendor models need their own review, which is covered in third-party AI impact assessment.

A clear scope statement prevents scope creep later. If a chatbot built for internal IT help starts answering benefits questions, the original assessment no longer covers it, and this checklist tells you to rerun it.

Block	Core question	Evidence to keep
Scope	What does the system do and for whom?	System description, intended use
People	Who could be affected, and how?	Stakeholder list, harm notes
Safeguards	What limits harm today?	Test results, human oversight rules
Monitoring	How will we notice drift or harm?	Metrics, review dates, owner

People and harm questions for your AI impact assessment checklist

Questions four to six focus on affected people. Who are the users, who are the subjects of decisions, and who is indirectly affected? Which groups could be treated differently, including by age, disability, language or location? What is the worst realistic outcome for one individual?

Rate each harm by severity and likelihood. A wrong product recommendation is minor. A wrong loan denial or a missed clinical flag can change someone’s life. The approach in AI impact assessment severity rating gives a simple four-level scale you can adopt.

Talk to real stakeholders where you can. Support staff, frontline clinicians and affected user groups often know failure modes the engineering team has never seen, and AI impact assessment stakeholders explains how to involve them without a large program.

Safeguard questions: what limits harm today

Questions seven to nine cover controls. What testing was done, and on what data? Is there meaningful human oversight, meaning a person who can understand and override the output, not merely a rubber stamp? What happens when the system is uncertain or fails?

Write down the safeguards that already exist and the ones you will add. Examples include bias testing across groups, confidence thresholds that route cases to a human, rate limits, logging, and a clear way for people to contest a decision.

Each residual impact should link to a named measure. The AI impact assessment mitigation guide shows how to map impacts to measures so nothing is left as a bare statement of concern.

Monitoring questions and review triggers

Questions ten to twelve address life after launch. What metrics show the system is behaving as expected? Who reviews them, and how often? What events force a fresh assessment, such as a model update, new data source, new user group or incident?

Good triggers are specific: retraining, a change in error rate beyond a set threshold, a complaint cluster, a new legal requirement or a change of vendor. Set an owner and a date, not just a principle.

Keep the review light but real. A quarterly check of a few indicators, described in AI impact assessment monitoring, beats an annual document nobody reads.

How the AI impact assessment checklist fits ISO 42005 and EU rules

ISO/IEC 42005 provides guidance for AI system impact assessment and is published by ISO; you can see the scope on the ISO/IEC 42005 page. It is guidance rather than a certifiable requirement, but it pairs with ISO/IEC 42001, which is a certifiable AI management system standard.

In the EU, the AI Act introduces a fundamental rights impact assessment for certain deployers of high-risk systems, and data protection law may require a DPIA where personal data is processed at high risk. A single well-structured assessment can feed several of these, so build it once and reuse it. Check current guidance on timing, because application dates for AI Act obligations are phased and have been subject to proposed adjustments.

Your checklist answers do not replace legal analysis, but they give counsel a factual base to work from.

Turning the AI impact assessment checklist into a report

A completed checklist is the raw material. The finished deliverable should state the system, list the impacts with ratings, show the safeguards and residual risk, and record an approval decision with a name and date.

Teams that want a ready structure can use the AI Impact Assessment Report, which provides the screening, system description, impacts on people and society, measures and a live workbook, so you fill in facts rather than design the format.

Whatever format you use, keep versions. When a regulator or customer asks what you knew at launch, the dated assessment is your answer.

A worked AI impact assessment checklist example

Imagine a mid-sized lender adding a model that pre-screens small business loan applications. Scope: the model ranks applications and routes low-ranked ones to manual review; it does not issue final denials. People: applicants, loan officers and, indirectly, small firms in under-served areas. The worst realistic harm is a viable business being wrongly delayed or turned away.

Safeguards: the lender tests approval rates across regions and business types, sets a confidence threshold below which a human reviews the file, and gives applicants a route to ask for review. Monitoring: monthly approval-rate gaps, quarterly sample audits and a rerun after every retraining. The figures in a real assessment would come from your own data, so treat this as a pattern, not a benchmark.

The lesson is that the AI impact assessment checklist produces concrete, checkable statements. Each answer can be tested later, which is what makes it useful evidence.

Who should complete the AI impact assessment checklist

Do not leave it to one function. The product owner answers scope and purpose, engineering supplies testing and data facts, legal or privacy reviews regulatory triggers, and a risk or compliance lead challenges the ratings. An executive sponsor signs the decision.

Hold a single working session of about two hours, using the checklist as the agenda, then follow up on gaps. This is faster than circulating a document for comments, and it surfaces disagreement early. Store the final version where your audit team can find it, and link it from the system record so the assessment travels with the system.

Common mistakes with an AI impact assessment checklist

The biggest error is treating it as a one-off form. Systems change, and so should the assessment. A second error is scoring only technical risk, such as accuracy, and missing harm to people. A third is leaving the owner blank; an unowned measure is not a measure.

Watch also for generic answers. Replace “we test for bias” with the test, the groups, the dataset and the result. Reviewers can tell the difference immediately.

Finally, do not skip the decision line. An assessment that never ends in approve, approve with conditions or reject has not done its job. See ISO 42001 impact assessment for how this decision connects to your management system.

AI impact assessment checklist FAQ

What is an AI impact assessment checklist?

It is a set of structured questions about an AI system’s purpose, affected people, safeguards and monitoring, answered before launch and kept as evidence.

Is an AI impact assessment mandatory?

It depends on the jurisdiction and use case. Some laws, such as the EU AI Act for certain deployers, require assessments, while ISO/IEC 42005 is voluntary guidance.

How is it different from a risk assessment?

A risk assessment focuses on risk to the organization, while an impact assessment focuses on effects on individuals, groups and society.

How long does it take?

A simple internal tool may take a day or two. A high-impact system can take several weeks because of testing and stakeholder input.

When should we redo it?

Redo it after a major model or data change, a new user group, a notable incident or a change in law.