Algorithmic Impact Assessments

An AIA borrows from environmental and privacy impact assessments: think through consequences before acting, write them down, and commit to mitigations. A good assessment usually covers the system's purpose and legal basis; the decision it supports and how much it replaces human judgement; data sources and their quality; affected groups, especially vulnerable ones; foreseeable harms such as discrimination, error, privacy loss or exclusion; oversight, explanation and appeal routes; and a plan for monitoring and review. Canada offers the best-known government example. Its Directive on Automated Decision-Making, in force since 2019, requires federal institutions to complete an Algorithmic Impact Assessment before using automated decision systems. The AIA is an online questionnaire with risk questions and mitigation questions. The score places the system at one of four impact levels, from little to very high impact, and each level triggers specific requirements, such as peer review, notice to affected people, human intervention in decisions and explanation. Completed assessments are published on the government's open data portal. The EU AI Act adds a fundamental rights impact assessment (FRIA) under Article 27. It applies to deployers of high-risk systems that are public bodies or private entities providing public services, and to deployers of certain systems such as credit scoring and life and health insurance pricing. The FRIA describes how and how often the system is used, who is affected, the specific risks, human oversight measures and what happens if risks materialise, and the deployer notifies the market surveillance authority. It complements, rather than replaces, a data protection impact assessment under the GDPR. A common misconception is that an AIA is a one-time compliance form. Its value comes from changing design decisions and from being revisited when the system, data or context changes.