Before an AI system goes live, the law may require one or more written assessments. They have different names and sources but ask similar questions.
Data protection impact assessment
Under the GDPR and UK GDPR, a DPIA is required where processing is likely to result in a high risk to individuals. Regulators treat many AI uses, such as profiling, new technologies and large-scale monitoring, as triggers. It must describe the processing, assess necessity and proportionality, and set out risks and safeguards.
Fundamental rights impact assessment
Under the EU AI Act, from December 2027, certain deployers of high-risk systems must assess the impact on fundamental rights before first use. This applies to public bodies, private bodies providing public services, and deployers using AI for credit scoring or life and health insurance pricing. It can build on an existing DPIA.
United States
California’s privacy regulations have required risk assessments since 1 January 2026 for processing that presents significant risk, including certain uses of automated decision technology, with the first submissions to the regulator due in 2028. Colorado’s revised AI law dropped its annual impact assessments.
The standard
ISO/IEC 42005, published in 2025, gives a structure for AI system impact assessment across the lifecycle that can sit underneath all of these.
Regulators do not want three documents that disagree. They want one honest assessment that answers each of their questions.
What to do
Build one AI impact assessment template with sections for each legal requirement that applies to you. Complete it before deployment, not after, and update it when the system or its use changes.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.