What it means
- A look outward: how could this AI system affect the people it touches (customers, employees, applicants) and society more widely?
- Different from SC-AI-005 AI risk assessment, which focuses on risk to the company. This asks about harm to individuals: unfair denial of a loan, exclusion of non-English speakers, loss of privacy, emotional harm, misinformation.
- Covers vulnerable groups (elderly, first-time digital users, people with disabilities) and Indian context such as language, region and caste or gender proxies.
Why it matters
- Regulators and frameworks (NITI Aayog, RBI FREE-AI's "People First" sutra) expect organisations to think about the people affected, not only the business risk.
- Impact assessments often surface issues early that are expensive to fix after launch.
- Enterprise buyers and government purchasers ask for them.
Checklist
- Create an impact assessment template: purpose, affected groups, possible harms, severity and reach, mitigations, residual impact, sign-off.
- Require it for every high risk system and for medium risk systems that are customer-facing.
- Combine with the DPDP privacy assessment where personal data is used, to avoid duplicate work.
- Involve someone outside the build team (compliance, customer experience, or an external reviewer for high risk).
- Feed mitigations into testing (SC-AI-017 Fairness and discrimination testing of outputs) and oversight design.
- Revisit after launch using complaints and monitoring data.
Evidence examples
- Signed impact assessment for the AI collections voice bot, listing affected groups and mitigations.
- Combined DPDP and AI impact assessment template, version-controlled.
- Committee minutes approving launch after reviewing the impact assessment.
- Follow-up review six months after launch referencing grievance data.
Common pitfalls
- Treating a privacy assessment alone as an AI impact assessment; it misses fairness and autonomy harms.
- Filling it in after launch as paperwork.
- Ignoring Indian context such as language access or regional variation.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- VoluntaryNIST AI RMF and GenAI Profile
- BindingKorea AI Basic Act
- SupervisoryOSFI E-23
Also relevant to
- NITI Aayog Responsible AI for Allno numbered obligations; mapped in its practical notes (accountability principle: risk and impact assessments)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 6.1.4 AI system impact assessment
- 8.4 AI system impact assessment (performed)
- A.5.2 AI system impact assessment process
- A.5.3 Documentation of AI system impact assessments
- A.5.4 Assessing AI system impact on individuals or groups of individuals
- A.5.5 Assessing societal impacts of AI systems
ISO/IEC 27001
- A.5.34 Privacy and protection of PII
SOC 2
No direct equivalent
Key takeaways
- Risk assessment asks "what could hurt us"; impact assessment asks "who could we hurt".
- Mostly new for AI. ISO 27001 overlap is partial and weak: only the privacy and PII side (A.5.34), which you can merge with a DPDP assessment.
- Require it for high risk and customer-facing systems, and revisit with post-launch data.