Impact Assessment
What is Impact Assessment?
An analysis of the potential consequences of a specific event, threat, or vulnerability being realised. Impact assessments consider financial, operational, reputational, legal, and regulatory consequences.
Terms that appear alongside impact assessment
Each of these is named in at least one of the same controls as impact assessment. The number is how many controls name both.
- data protection 72 shared controls
- data protection impact assessment 57 shared controls
- gdpr 49 shared controls
- consent 40 shared controls
- high risk processing 29 shared controls
- transfer impact assessment 28 shared controls
- privacy impact assessment 26 shared controls
- certification 25 shared controls
Frameworks that govern impact assessment
What the standards actually require on impact assessment
Requirements naming impact assessment across 6 standards, quoted from the control text.
The scope section should describe the AI system in question, its foreseeable impacts and the internal and external factors that shape them, including: identification of the AI system;
iso-iec-42005-2025::6.2 · Scope of the AI system impact assessment (documented) →The plan must require that event data is analysed to determine the potential impact on essential functions, with consistent criteria for measuring impact and the API 1164 impact assessment used to determine the potential impact on the environment.
api-1164::DE.AE-4 · DE.AE-4 Event impact determined with consistent criteria and the API 1164 impact assessment →The organisation conducts privacy impact assessments when designing, developing or procuring means of handling personal information and when starting a new collection.
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-08 · RA-08 Privacy impact assessments →Governments should adopt a regulatory procedure, particularly for public authorities, to conduct ethical impact assessments that predict consequences, mitigate risks and facilitate citizen participation, with oversight through auditability, traceability and ex...
unesco-recommendation-on-the-ethics-of-ai::PA1b · para 53 Public authorities: carry out transparent, multidisciplinary ethical impact assessments with auditability and external review, and monitor deployed systems →For every in-scope AI use case the agency must carry out an impact assessment of the use case, begun at the design stage and finalised, with any agreed risk treatments applied, before the solution is deployed.
australia-policy-for-the-responsible-use-of-ai-in-government-version-2-0::4.2 · Conduct an AI use case impact assessment for every in-scope use case and apply treatments before deployment →Each time new processing of personal data, or a change to current processing, is planned, the organization must judge whether a privacy impact assessment is required and carry one out where appropriate.
iso-iec-27701-2025::A.1.2.6 · Privacy impact assessment →Questions people ask about impact assessment
What is Impact Assessment?
Why is Impact Assessment important for compliance?
Which compliance frameworks address Impact Assessment?
Where can I learn more about Impact Assessment?
See how Impact Assessment applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.