Use this for one AI system at a time, after it is in the AI register and classified. You get two documents per AI system in a new folder, ./ai-impact-assessment/: the impact assessment itself, a report of who the system could harm, how badly, and what reduces it, ready for the owner to sign (<system-id>-assessment.md), and a short list of questions each owner still has to answer (<system-id>-open-questions.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The signature belongs to the system owner and an accountable executive, never the agent.

Inputs to gather

Read the register entry and classification record, the design or product documentation, test and evaluation results (especially any broken down by group), the user interface or workflow where the output is used, complaints or support tickets about the feature, and any privacy impact assessment that exists. Ask the reader, in one message: who decides based on the output, how many decisions a day, what happens to a person when the system is wrong in each direction, and how a person can contest an outcome.

Step 1: decide which assessment this is

Several assessments look alike and audiences differ. Say at the top which this document serves: the AI management system impact assessment (run a framework lookup for what the standard expects it to cover and record), a fundamental rights impact assessment under EU AI Act Art. 27 for the deployers that article names, a data protection impact assessment under GDPR Art. 35, or the company's own launch gate. A fundamental rights impact assessment is done before first use and its result is notified to the market surveillance authority on the official template; without the notification it is incomplete. Screen for a data protection impact assessment too (GDPR Art. 35): one is expected where a systematic and extensive evaluation of people, based on automated processing including profiling, is the basis for decisions with legal or similarly significant effects (Art. 35(3)(a)). Employment and credit uses deserve a careful screen against that test; the context alone does not decide it. One document can feed several if each section says which. Do not let the privacy assessment stand in for the others; it covers personal data, not unfair outcomes or safety.

Step 2: describe the system in context

Write half a page: intended purpose, reasonably foreseeable misuse, the people affected (users, people the output is about, bystanders), the setting, how autonomous the output is, how reversible a wrong outcome is, and the volume. Rule of thumb: if you cannot name the person who bears the cost of a false positive and the person who bears the cost of a false negative, stop and ask; the assessment cannot be done yet.

Step 3: work through impacts with evidence

For each category, record who is affected, how, the evidence (with its provenance: test set, date, who ran it), a severity and a likelihood: