Free template
One impact assessment, not three
Data protection, the EU AI Act and equality law can each ask for an assessment of the same AI use. This template covers all three in eight questions, plus a decision-rights matrix that says who decides what.
Only for the uses that matter
Most AI use needs no individual assessment. This one is for tier 3 uses from the AI inventory: anything that informs a decision about a person, talks to customers unsupervised, can act in other systems, or handles special-category data. For most mid-sized businesses that is a handful of uses.
Running a data protection impact assessment, a fundamental rights assessment and an equality check separately, by three teams, produces three documents that do not agree. One assessment, borrowing the structure of ISO/IEC 42005, does the job once.
What the assessment asks
- The use. What decision or process is affected, whether the AI informs, recommends or decides, and who is affected.
- The data. What personal data, from where, on what lawful basis, minimised how, and kept how long.
- The people. Could any group be disadvantaged, including by age, sex, race or disability? Can people without digital access, or with a disability, reach an equivalent route?
- The sources. What the AI draws on to answer, and how those documents are kept accurate, current and access-controlled.
- The errors. How it can be wrong, how often, what a wrong output does to the person affected, and how it would be noticed.
- The oversight. Who reviews, with what authority, understanding and time.
- The rights. How people are told, how they can challenge a decision and reach a person, and how quickly.
- The decision. The remaining risks, the controls that reduce them, and the owner's signed acceptance.
Four ingredients of a real human in the loop
A person clicking "Approve" on hundreds of recommendations a day is a signature, not oversight. Real oversight needs all four.
Authority
The reviewer can overrule the AI without permission or penalty, and overruling is a normal, recorded event.
Understanding
The reviewer sees the evidence behind the recommendation, and knows where the system tends to fail.
Time
Enough time per case to look at the evidence. Oversight measured by throughput drifts towards confirmation.
Accountability
The person, not the system, owns the outcome and can explain it to the person affected.
How to tell if oversight is working
The override rate. How often reviewers disagree with the AI. Close to zero, on a task where the AI is not perfect, means nobody is really reviewing.
A sample audit. Now and then, a second person re-decides a sample of cases from the evidence alone, without the AI's recommendation, and the two are compared.
When a reviewer overrules the AI, record why in a sentence. Over a few months those sentences show where the system is weak. See human in the loop: where the threshold goes.
Who decides what, written down
One row for each kind of decision the business makes with AI involved. The thresholds and wording are yours to set.
| Decision | AI's role | Person's role | Accountable | Challenge route |
|---|---|---|---|---|
| Draft reply to a complaint | Drafts | Reads, edits, sends | Service team lead | Normal complaints process |
| Refund under £[x] | Recommends | Approves each; monthly sample audit | Head of service | Review by a manager |
| Shortlist for interview | Summarises applications against criteria | Reads every application before shortlisting | Hiring manager | Candidate can ask for reconsideration |
| Flag possible fraud | Flags | Investigates before any action | Finance controller | Customer told and can respond |
Every row names an accountable person, says what the person actually does, and gives the affected person a way to challenge. A row where the person's role is "approves" and nothing else should be read again.
Using the template
Does this replace our data protection impact assessment?
It is built to cover the same ground, plus the EU AI Act and equality questions, so one document does the job. Check it with your data protection lead, who signs off the data protection part.
Who signs the assessment?
The owner of the use, who accepts the remaining risk on the business's behalf, within the level the board has agreed.
Is this legal advice?
No. For uses in the EU AI Act's high-risk categories, such as recruitment, credit or access to services, take legal advice as well.
Assess before you switch it on
GOVERN chapter 10 covers the cases, the law and the controls behind this template in full. Or we can run the assessment with you.