AI Impact Assessment

An AI impact assessment is a structured evaluation of the effects an AI system has on the people it processes data about or makes decisions affecting — covering concerns like fairness, discrimination, safety, and fundamental rights — rather than the risk the system poses to the organization deploying it. This distinguishes it from an AI risk assessment, which evaluates organizational exposure (data exposure, security, compliance risk) for a specific system. An impact assessment is outward-facing: it asks what happens to an applicant denied a loan by an automated system, a patient whose treatment plan an AI tool influenced, or an employee whose performance an algorithm scored — not just what the organization itself stands to lose.

The two are closely related and often performed together, since much of the underlying analysis — what data the system uses, what decisions it makes, who it affects — feeds both. But they can produce different conclusions: a system might present low organizational risk (well-secured, contractually sound, low data exposure) while still having significant impact on the people subject to its decisions, particularly if its outputs are biased, inconsistently applied, or made without adequate human review. Several legal frameworks specifically require this outward-facing assessment: GDPR's Data Protection Impact Assessment (DPIA) for processing likely to result in high risk to individuals, and the EU AI Act's Fundamental Rights Impact Assessment, required for certain deployers of high-risk AI systems, are both built around evaluating impact on people rather than risk to the organization.

A bank deploying an AI-driven credit scoring model is a clear example of where an impact assessment applies distinctly from a risk assessment. The bank's risk assessment might focus on whether the model's provider introduces third-party data exposure or whether the vendor relationship satisfies the bank's own security requirements. The impact assessment asks a different set of questions: does the model produce systematically different outcomes across demographic groups, can an applicant understand and contest a denial, and is there meaningful human review before a decision becomes final. Both assessments matter, but they answer different questions about the same system.

The same distinction applies broadly wherever AI affects people directly: a hospital using an AI tool to help triage patients needs to assess not just whether the tool protects PHI or medical identifiers, but whether its triage recommendations are clinically sound and consistently applied across patients; an employer using an AI tool to screen job applicants needs to assess whether the tool's outputs disadvantage particular groups of candidates, separate from whatever data protection controls apply to applicant payroll data or personal information; and an insurer using an algorithm to price policies needs to assess whether the pricing model's effects are fair and explainable to the people it prices, not just whether the underlying data is well secured. In each case, the impact assessment is what surfaces effects on real people that a purely organizational risk assessment wouldn't necessarily catch.

Organizations that evaluate AI systems only for organizational risk — without a separate assessment of impact on affected people — can end up with a system that looks acceptable by every internal metric while still producing unfair, harmful, or legally problematic outcomes for the people subject to its decisions. A well-secured, contractually sound AI system can still discriminate, mislead, or make consequential decisions without adequate human oversight, and none of those problems necessarily show up in an assessment built only to evaluate the organization's own exposure.

Treating a strong organizational risk assessment as sufficient on its own is a mismatch — a system can be secure and well-governed from the organization's perspective while still needing separate scrutiny for its effects on the people it actually touches.

An AI impact assessment evaluates a broader question than Questa AI is built to answer — fairness, discrimination, and effects on affected individuals are outside what a data protection tool addresses. Where Questa is relevant is at the data layer underlying part of that assessment: its entity-detection engine performs local redaction and masking of sensitive identifiers, including categories like medical identifiers and payment records, functioning as a privacy firewall before that data reaches an external AI model.

This matters for the data-protection dimension that often sits alongside an impact assessment — for example, GDPR treats a DPIA and appropriate data protection measures as related but distinct obligations, and Questa's Blackbox recording and governance dashboard can provide documented evidence of what sensitive data was protected and when, supporting that adjacent data-protection question. It doesn't substitute for the fairness, discrimination, or rights-based analysis an impact assessment itself requires, which needs separate evaluation focused specifically on the system's effects on the people it touches, not on how well the underlying data was protected before reaching the model.