AI impact assessments as the AIGP tests them

One performance indicator appears twice in the AIGP's Body of Knowledge, word for word but for one adjective: "Perform or review an impact assessment on the AI system" in Domain III, and "Perform or review an impact assessment on the selected AI system" in Domain IV. The law domain adds privacy impact assessments and "conformity/impact assessments", and the standards competency names three ISO standards, 42005 among them. Impact assessment is the one activity the exam asks of builders and deployers alike. This guide sets out what an AI impact assessment is, how it differs from a risk assessment, the two the EU law requires, the GDPR's data protection impact assessment and the AI Act's fundamental rights impact assessment, what the NIST AI RMF adds, where the US stands after Colorado's 2026 law, and one sequence that serves all of them.

The short answer

• The exam's ask: perform or review an impact assessment, as a builder (III.A) and as a deployer (IV.B), and know the legal requirements around it (II.A, II.C).
• The GDPR's DPIA: required of a controller before processing "likely to result in a high risk to the rights and freedoms of natural persons", always including automated evaluations of people that produce legal or similarly significant effects.
• The AI Act's FRIA: required before first use from public bodies, private entities providing public services, and deployers of high-risk credit scoring and life and health insurance pricing systems. Its obligation starts with the Annex III high-risk rules on December 2, 2027.
• The provider's side: a risk management system across the life cycle, and information that deployers use for their own assessments.
• NIST: the MAP function, which frames risk in context and characterizes impacts, voluntary and usable for any system.
• One sequence: context, affected people, risks, mitigations and oversight, consultation, documentation, review.

What the Body of Knowledge asks

The indicators, in the Body of Knowledge's words:

• III.A, designing and building: "Perform or review an impact assessment on the AI system."
• IV.B, assessing a system to deploy: "Perform or review an impact assessment on the selected AI system."
• II.A, privacy law: obligations on data controllers, including "regarding privacy impact assessments".
• II.C, AI-specific law: "Understand the key requirements around risk management, data governance, technical documentation, conformity/impact assessments and record keeping."
• II.D, standards: "Understand the core ISO AI standards (i.e., 22989, 42001 and 42005)."

The verbs matter. "Perform or review" means the exam can put you on either side: running an assessment for your own system, or judging one a vendor or a colleague has done. Scenario questions in Domains III and IV can describe a step and ask what should come first, and these two indicators are where the Body of Knowledge places the assessment: before building, and before deploying.

What is an AI impact assessment?

The IAPP's glossary defines it: "An evaluation process designed to identify, understand and mitigate the potential ethical, legal, economic and societal implications of an AI system." Three features of that definition carry into every legal version. It is a process, not a document. It looks outward, at implications for people and society. And it ends in mitigation, not only in a description.

AI impact assessment vs AI risk assessment

The glossary adds that an impact assessment is "Also referred to as a risk assessment", and in everyday use the two names overlap. The law separates them by owner and focus.

• An impact assessment asks what a use of AI will do to people. The GDPR's version is about personal data and the rights of data subjects; the AI Act's is about fundamental rights. Both belong to the organization that decides to use the system: the controller, or the deployer.
• A risk management system, in the AI Act's sense, belongs to the provider of a high-risk system and runs for the system's whole life. Article 9: "A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems." It is "a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system", covering "the identification and analysis of the known and the reasonably foreseeable risks that the high-risk AI system can pose to health, safety or fundamental rights".

So when a question asks who should assess the effect of a credit-scoring tool on a particular bank's applicants, the answer is the deployer's impact assessment; when it asks who must manage the tool's risks across its life, it is the provider's risk management system. The two meet: Article 26(9) tells deployers to "use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment".

The GDPR's data protection impact assessment

Article 35(1) sets the trigger: "Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data."

Article 35(3) lists cases where it is always required, and the first describes many AI systems: "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person". The other two are large-scale processing of special categories of data and large-scale systematic monitoring of a publicly accessible area.

The assessment must contain, under Article 35(7), a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures to address them. The controller "shall seek the advice of the data protection officer, where designated", should where appropriate seek the views of data subjects, and must review the assessment when the risk changes. If the assessment shows a high risk that the controller has not mitigated, Article 36 applies: "The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk."

This one applies today, to any AI system that processes personal data in a way likely to create a high risk.

The AI Act's fundamental rights impact assessment

Article 27 adds a second assessment for certain deployers of high-risk systems. It applies "Prior to deploying a high-risk AI system referred to in Article 6(2)", other than critical infrastructure systems, to "deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III". Those two points are systems "intended to be used to evaluate the creditworthiness of natural persons or establish their credit score", fraud detection excepted, and systems "intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance".

The assessment has six parts, set out in Article 27(1):

1. the deployer's processes in which the system will be used, in line with its intended purpose;
2. the period and frequency of use;
3. "the categories of natural persons and groups likely to be affected by its use in the specific context";
4. the specific risks of harm to those people, using the provider's information under Article 13;
5. "a description of the implementation of human oversight measures, according to the instructions for use";
6. "the measures to be taken in the case of the materialisation of those risks, including the arrangements for internal governance and complaint mechanisms".

It applies "to the first use of the high-risk AI system", must be updated if any element changes, and its results go to the market surveillance authority on a template from the AI Office. The 2026 amendment made the overlap with the GDPR explicit: where an obligation "is already met through the data protection impact assessment", the deployer may "include cross-references to the relevant sections of that data protection impact assessment or include relevant parts thereof".

The timing follows the high-risk chapter. Article 27 sits in Section 3 of Chapter III, which applies to Annex III systems from December 2, 2027 after the 2026 amendment; EU AI Act timeline: the dates after the Omnibus has the detail. A deployer that already runs DPIAs has until then to extend them.

What the NIST AI RMF adds

The NIST framework has no legal force, but it gives the most general method. Its MAP function "establishes the context to frame risks related to an AI system", and its first subcategory, MAP 1.1, asks that intended purposes, uses, laws and settings be understood and documented, with considerations that include "potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet". Its fifth category, MAP 5, is about characterizing impacts on people and organizations, with MAP 5.1 asking that the likelihood and magnitude of each identified impact, beneficial and harmful, be identified and documented, drawing on expected use, past uses in similar contexts, public incident reports and outside feedback.

For an AIGP candidate, NIST is the way to describe an impact assessment for a system no law covers: a framework applied voluntarily, with the same steps the laws require. The NIST AI RMF as the AIGP tests it covers the rest of the framework.

In the United States

The United States has no comprehensive federal AI law, and the most prominent state requirement is gone. Colorado's 2024 AI Act carried an impact assessment obligation; its 2026 replacement does not. The IAPP's report: "The shift means the law no longer carries obligations for a duty of care, risk management programs or impact assessments." The Body of Knowledge was approved in September 2025, while the 2024 model still stood, so an exam question may still describe a state law that requires one. US state AI laws as the AIGP tests them sets out what replaced it.

One sequence for every assessment

The instruments differ, but their steps line up, and a single sequence covers the GDPR, the AI Act and NIST at once.

1. Context. What the system is for, where it will run, how often, under which laws (DPIA's description; FRIA points 1 and 2; MAP 1.1).
2. Affected people. Who the system's outputs will touch, including groups, not only individuals (FRIA point 3; MAP 5).
3. Risks. Likelihood and severity of harm to rights, safety and interests, using the provider's documentation (DPIA's risk assessment; FRIA point 4; MAP 5.1).
4. Mitigations and oversight. Safeguards, human oversight, complaint routes and what happens if a risk materializes (DPIA's measures; FRIA points 5 and 6).
5. Consultation. The data protection officer, affected people or their representatives, and the supervisory authority if a high risk remains (Article 35(2) and (9); Article 36).
6. Record and notify. Keep the assessment, and file the FRIA's results with the market surveillance authority where Article 27 applies.
7. Review. Revisit when the system, its data or its use changes (Article 35(11); Article 27(2)).

Run as one process, the assessment answers both laws and the framework, and the AI Act's cross-reference rule lets the documents share sections.

Where to start

The AIGP's first competency, AI and the need for governance, is free in full with a free account: five lessons, 100 questions and 118 flashcards on what AI is, its risks and harms, and the principles every impact assessment applies. The rest of the course takes the Body of Knowledge through the laws, development and deployment, where impact assessment questions sit, with practice in the exam's format. AIGP exam questions: what they look like shows how scenario questions are built.