Impact assessments can be used to determine how potentially risky or harmful something is in terms of a low, medium, or high impact. While impact assessments are not novel nor exclusively used in the context of AI - they are used in the context of planning applications to determine the environmental impact of the build, policy and regulation to establish best practices, and when making decisions about public services to determine the impact on equality – they are increasingly being used to determine the impact that AI systems might have on users and other relevant stakeholders.

Most relevant to automated systems are Algorithmic Impact Assessments (AIAs) and Data Protection Impact Assessments (DPIAs), both of which are required by the proposed Workplace Technology Accountability Act in California. The upcoming EU AI Act also requires AIAs to determine whether a system designated as high-risk in Annex III poses a significant risk to fundamental rights, health, or safety, subjecting it to the most stringent requirements This blog post gives an overview of AIAs, DPIAs, and the difference between them, providing some examples of legislation that requires them.