An AI impact assessment: Which activity should the lead perform?

Structurally evaluating effects on individuals and the safeguards needed is the purpose of an AI impact assessment.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. A penetration test, evaluating the hosting environment for exploitable vulnerabilities that an attacker could use to intrude.

   Plausible but wrong: a penetration test assesses security exposure, not the system's broader effects on applicants' rights.
2. An AI impact assessment, evaluating the system's potential effects on individuals and the safeguards needed to reduce them. ✓

   Correct: an AI impact assessment structurally evaluates effects on people and identifies mitigating safeguards, exactly the need described.
3. A vendor SOC 2 review, evaluating a supplier's audited controls over security, availability and confidentiality practices.

   Plausible but wrong: a SOC 2 review examines a vendor's control environment, not the deployed tool's impact on affected individuals.
4. A unit test suite, evaluating whether individual software components return the correct outputs for defined input cases.

   Plausible but wrong: unit testing verifies code correctness at the component level, not societal or rights impacts of the system.

How to remember it

Structurally evaluating effects on individuals and the safeguards needed is the purpose of an AI impact assessment.

More Understanding How to Govern AI Deployment and Use questions

• Retrieval-augmented generation: Which technique best fits this need? →
• A data-use clause restricting the vendor from using: Which contract term most directly addresses this concern? →
• The company assumes greater direct accountability: Which risk best answers this? →
• All 424 Understanding How to Govern AI Deployment and Use questions →