AI System Impact Assessments Procedure

Document control

AI System Impact Assessments Procedure

Document ID: B-003

Author(s): GRC & Compliance Team

Version: 1.0

Date: 09-Nov-2026

Disclaimer:

This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.

Document Details

Revision History

1. INTRODUCTION

1.1 Purpose (Clause 3.24, 6.1.4, A.5.1 Objective)

The purpose of this procedure is to define a formal, documented process by which the organization assesses the potential consequences (impacts) that can result from the development, provision, or use of an AI system on:

1. 1. Individuals and defined groups of individuals.
2. 2. Societies (e.g., economic, environmental, and legal systems).

The Impact Assessment serves as the foundation for the subsequent AI Risk Assessment (6.1.2) by identifying the source and magnitude of potential harm (A.5.1 Objective).

1.2 Scope (Clause 6.1.4)

This procedure applies to any AI system (newly developed, procured, or materially enhanced) that falls within the scope of the AIMS. The assessment must cover the AI system throughout its entire life cycle (from design/data acquisition through decommissioning).

Scope determination explicitly considers indirect impacts on individuals (A.5.4) and society (A.5.5): where an in-scope AI system's outputs affect natural persons who are not the organization's direct customer (e.g., end-recipients of a message classified by the system, or members of the public affected by a platform decision), the AI System Owner shall not exclude A.5.4/A.5.5 from the assessment solely on the basis that the organization's contractual relationship is business-to-business. Any proposed exclusion of A.5.4 or A.5.5 from the Statement of Applicability requires documented justification and AIGC approval, reviewed at least annually.

1.3 Objectives

The primary objectives are to ensure:

1. 1. Mandatory Compliance: The assessment is defined and performed according to the requirements of Clause 6.1.4, 8.4, and Controls A.5.2 through A.5.5.
2. 2. Risk Integration: The potential consequences identified by the assessment (6.1.4) are formally documented and considered in the organization's AI Risk Assessment (6.1.2).
3. 3. Comprehensive Analysis: The assessment determines impacts related to the intended use, foreseeable misuse, technical context, and societal context (6.1.4).
4. 4. Trustworthiness Focus: Evaluation addresses core AI trustworthiness topics (e.g., fairness, privacy, security, safety) as they affect individuals and society (B.5.4, B.5.5).
5. 5. Documented Evidence: Assessment results are retained for a defined period (A.5.3) and made available to relevant interested parties where appropriate (A.5.4).

2. ROLES, RESPONSIBILITIES, AND AUTHORITIES

3. PROCEDURE FOR AI SYSTEM IMPACT ASSESSMENT LIFE CYCLE

This procedure is executed in four mandatory phases, ensuring compliance with the assessment and documentation requirements of the standard.

PHASE 1: INITIATION AND PLANNING (Clause 8.4, A.5.2)

3.1 Determine Assessment Trigger (8.4)

The AI System Owner shall initiate an Impact Assessment upon the occurrence of any of the following mandatory triggers:

1. 1. New System Development: Prior to the start of the design phase for any new AI system.
2. 2. Material Enhancement: When significant changes are proposed to an existing AI system (e.g., changes to intended purpose, model architecture, or data types/sources).
3. 3. Planned Interval: At the annual planned interval (e.g., concurrent with the Management Review cycle).
4. 4. Ad-Hoc Triggers: Following a significant incident (10.2), a legal/regulatory change, or a directive from the AIGC Committee.

3.2 Define Scope and Context (6.1.4)

The AI Impact Assessment Team Lead shall formally define and document the scope of the assessment, including:

1. 1. Intended Purpose and Use: The documented rationale, goals, and domain of application of the AI system.
2. 2. Specific Technical Context: Hardware, software components, computational resources, and the level of automation (B.5.2).
3. 3. Societal Context and Jurisdictions: The specific environment, culture, values, norms, and applicable jurisdictions where the system will operate (6.1.4).
4. 4. Target Groups: Identification of specific demographic groups (e.g., children, workers) or geographic areas potentially impacted (B.5.4).

3.3 Form Assessment Team and Resources (B.5.4)

The AI System Owner ensures the team has the necessary interdisciplinary competence (7.2), which may include:

• AI/ML Engineers
• Domain Experts (e.g., medical, finance)
• Data Scientists
• Legal/Compliance Experts
• Ethics or Human Factors Professionals

PHASE 2: IDENTIFICATION AND ANALYSIS (A.5.4, A.5.5)

3.4 Identify Foreseeable Misuse (6.1.4)

The team must systematically identify and document the reasonably foreseeable misuse (B.5.3) of the AI system, regardless of the intended purpose. This must include analysis of how external actors or internal personnel could manipulate the system for unintended harm (e.g., use for discriminatory screening, misinformation).

3.5 Assess Impacts on Individuals and Groups (A.5.4)

The assessment must evaluate how the AI system's characteristics (data, technology, functionality) affect individuals and groups. This includes analyzing impacts in the following areas (B.5.4):

• Fairness and Bias: Potential for discriminatory outcomes based on data or algorithmic structure.
• Security and Privacy: Impact on data subjects' PII and susceptibility to security threats.
• Safety and Health: Risks of physical or psychological harm due to system failure or misuse.
• Transparency and Explainability: Ability for users and interested parties to interpret outputs and decisions.
• Financial and Human Rights: Impact on life opportunities, access to services, and fundamental human rights.

3.6 Assess Societal Impacts (A.5.5)

The assessment must evaluate the potential macro-level consequences, both beneficial and detrimental (B.5.5):

• Environmental Sustainability: Impact of required computing resources (e.g., greenhouse gas emissions).
• Economic Impact: Effect on employment, job displacement, and access to financial systems.
• Governance and Justice: Impact on legislative processes, misinformation potential, and criminal justice systems.
• Norms and Culture: Analysis of whether the system reinforces or mitigates unwanted historical social biases.

3.6.1 Assess Societal Impacts (A.5.5)

To evidence that individual and societal impacts are assessed throughout the AI system's life cycle, and not only at initial deployment, the following review points shall be considered:

PHASE 3: EVALUATION AND TREATMENT (6.1.4, 6.1.2)

3.7 Evaluate Consequences and Likelihood (B.5.2)

The team formally evaluates the identified impacts:

1. 1. Consequence Analysis: Rate the severity of the potential harm if the impact materializes (e.g., Minor, Moderate, Severe, Catastrophic).
2. 2. Likelihood Analysis: Assess the realistic likelihood of the impact occurring (e.g., Rare, Unlikely, Possible, Likely).

3.8 Determine Mitigation Measures (B.5.2)

For all identified negative impacts, the team must define mitigation measures (treatment). Mitigation should follow a hierarchy (e.g., eliminate, reduce, isolate) and may involve:

• Changes to the system's design or data requirements (e.g., data quality controls, model constraints).
• Implementation of human oversight capabilities (B.5.3).
• Recommending changes to the scope or intended use of the system.

3.9 Link to AI Risk Assessment (6.1.2)

The final consequences and mitigation measures must be formally transferred to the AI Risk Assessment process (6.1.2). The identified impacts form the "consequences" that are then paired with "likelihood" to determine the residual risk level according to the organization's risk criteria (6.1.1).

PHASE 4: DOCUMENTATION, REVIEW, AND COMMUNICATION (A.5.3, 8.4)

3.10 Documentation and Retention (A.5.3, 7.5)

The AI Impact Assessment Team Lead shall ensure the entire process is documented in the AI System Impact Assessment Report (Appendix C).

• Retention: The documented results must be retained for a minimum of three (3) years or for the duration required by applicable law or regulation (e.g., DPDPA 2023, TRAI/DoT guidelines, sector-specific requirements), whichever is longer and informed by organizational retention schedules and legal requirements (A.5.3).

3.11 Management Review and Approval

1. 1. Internal Review: The assessment findings and proposed mitigations are reviewed by the AI System Owner and the Head of Risk Management.
2. 2. AIGC Approval: For High-Risk AI Systems, the final documented results are submitted to the AIGC Committee for approval of the proposed mitigations prior to system deployment.

3.12 Availability of Impact Assessment Evidence to Interested Parties (A.5.4)

Where the AI system's impact assessment identifies effects on individuals, groups, or society that are relevant to an interested party, the GRC Team shall make appropriate evidence available as follows:

• Internal Interested Parties: The full Impact Assessment Report is available to the AIGC Committee, AI System Owner, Head of Risk Management, and Internal Audit on request.
• Customers and Enterprise Users: A redacted summary of findings (excluding confidential technical detail) is made available upon written request, per A.8.2, within a defined SLA (target: 10 business days).
• Regulators: Full or summarized results are made available upon a lawful regulatory request, per A.8.5, coordinated by Head of Legal & Compliance.
• Affected Individuals or Groups: Where an assessment identifies a material adverse impact on an identifiable individual or group, the AI System Owner, in consultation with Legal & Compliance, determines and documents an appropriate method of notification or access, consistent with applicable privacy law and the Concern Reporting Process (AIMS-B-004).

The specific parties notified, the evidence shared, and the date shall be recorded in Section 11 (Documentation, Retention & Communication) of the Impact Assessment Report.

3.13 Communication (6.1.4, A.8)

The results of the assessment shall be considered when determining what information should be communicated to relevant interested parties (A.8), particularly concerning:

• Potential benefits and harms of the system (B.8.2).
• Technical limitations and predictable failures (B.5.3).
• Measures taken to mitigate impacts on vulnerable groups.

4. PROCESS MAP: AI SYSTEM IMPACT ASSESSMENT LIFE CYCLE

5.APPENDIX A: IMPACT AREAS CHECKLIST (A.5.4, A.5.5)

This checklist provides a mandatory list of areas to be examined during Phase 2 (Identification and Analysis).

A.1 Impacts on Individuals or Groups (A.5.4, B.5.4)

A.2 Societal Impacts (A.5.5)

6. APPENDIX B: IMPACT ASSESSMENT TRIGGER CHECKLIST (8.4)

The AI System Owner uses this checklist during the planning phase to confirm if an Impact Assessment is mandatory or recommended.

7. APPENDIX C: IMPACT ASSESSMENT REPORT TEMPLATE (A.5.3, 7.5)

This template serves as the mandatory documented result of the Impact Assessment (6.1.4, A.5.3). The final report must be retained for a defined period (A.5.3).

8. APPENDIX D: CONTINUAL IMPROVEMENT OF THE PROCEDURE (10.1)

This procedure itself is subject to continual improvement (10.1). The AI Product Owner (in consultation with the AIMS Manager) shall recommend updates based on the following:

1. 1. Audit Feedback (9.2): Internal or external audit observations related to the consistency, validity, or comparability of the assessment results (6.1.2).
2. 2. Process Performance (9.1): Analysis of instances where the Impact Assessment failed to predict a Critical Concern or Nonconformity, indicating gaps in the Foreseeable Misuse (6.1.4) analysis (B.5.3).
3. 3. Lessons Learned (10.2): Insights gathered from the Nonconformity and Corrective Action process where remediation required changes to the Impact Assessment template or methodology.
4. 4. External Standards: Review of new guidance (e.g., from NIST AI RMF, ISO/IEC 23894) to ensure the methodology remains current with international best practice.
5. 5. SOA Applicability Review: Annual re-evaluation of any SOA exclusion of A.5.4/A.5.5, informed by actual system reach into individuals/society evidenced in completed Impact Assessment Reports (e.g., systems with downstream consumer effect such as SecureXcel AI Services).

More in AI risk, impact and assurance

• AI Risk Management and Customer Relationship Procedure
• AI Risk Criteria and Assessment Methodology Procedure
• AI Model Monitoring and Improvement Policy