An AI impact assessment records the system's purpose and expected benefit, the data and model fit, potential impacts on people, a reassessment plan, costs, an independent review, and a signed risk acceptance. US federal guidance M-25-21 lists these elements for high-impact AI, and they work as a template for any organization.
The source of this outline
OMB memorandum M-25-21, dated 3 April 2025, requires agencies to complete a documented AI impact assessment before deploying a high-impact AI use case and to update it periodically through the lifecycle. It sets out minimum contents. Private companies are not bound by it, but it is a clear public model.
Template sections
1. Intended purpose and expected benefit. What the system is for, supported by specific metrics or qualitative analysis, compared with the existing process.
2. Data and model quality. A summary of the data used in design, development, training, testing and operation, how it was collected and prepared, and whether it fits the intended purpose. Note where data includes information about protected classes.
3. Potential impacts. Effects on privacy, civil rights, civil liberties and other rights, including the effect of using or not using AI, and planned mitigations for anticipated harms such as unlawful discrimination. For companies, add customer, employee and safety impacts.
4. Reassessment plan. A schedule for periodic reassessment, and triggers such as significant modification of the system.
5. Costs. Direct costs and expected savings.
6. Independent review. Someone who was not involved in building it reviews the assessment and notes concerns or gaps. Their comments are included in the documentation and passed to whoever accepts the risk.
7. Risk acceptance. A signature from the individual accepting the risk.
Pair it with the other practices
The same memo lists related minimum practices for high-impact AI: pre-deployment testing with mitigation plans, ongoing monitoring, training for operators, human oversight with fail-safes where practicable, and timely human review and appeal for people affected by AI-enabled decisions. These make a good checklist for what the assessment should lead to.
How to keep it light
Use the full template for high-tier systems only. For lower tiers, a one-page version with purpose, data, impacts and owner is enough.
Who writes it
The system owner drafts it, with security, privacy and legal input. The independent reviewer should come from outside the delivery team.
Mistakes to avoid
Do not write the assessment after launch to justify a decision already made. Do not let the builder be the only reviewer. Do not list impacts without mitigations or owners. And do not skip the reassessment schedule: an assessment that never changes is probably out of date. Treat it as a living record attached to the system, and update it when the model, data or use changes.
Quick check
Is an impact assessment the same as a risk assessment?
They overlap. An impact assessment focuses on effects on people and the purpose served. A risk assessment looks at likelihood and magnitude of a wider set of risks. Many teams combine them.
When should it be updated?
On the schedule you set and after significant changes to the system, its data or its use.
Sources
Last reviewed: 19 October 2026.
