AI Impact Assessment Template for EU AI Act Compliance

Impact assessments are central to EU AI Act compliance, yet most SMEs confuse two distinct obligations: the provider's risk management system (Article 9) and the deployer's fundamental rights impact assessment (Article 27). Both require structured documentation, but they serve different purposes, apply to different roles, and demand different evidence. This guide clarifies both obligations and provides a practical template structure SMEs can use immediately.

Two obligations, two roles

The EU AI Act creates two separate impact assessment requirements for high-risk AI systems:

Article 9 — Risk management system (provider obligation)
Providers of high-risk AI systems must establish, implement, document, and maintain a continuous risk management system throughout the AI system's lifecycle. This covers identification, analysis, estimation, and evaluation of known and foreseeable risks, plus adoption of risk management measures. The output is a living technical document that evolves with the system.

Article 27 — Fundamental rights impact assessment (deployer obligation)
Deployers of high-risk AI systems listed in Annex III must conduct a FRIA before putting the system into use. This assessment evaluates potential impact on fundamental rights of affected persons, including non-discrimination, privacy, dignity, and access to effective remedy. It is context-specific: the same AI system deployed in different settings may require different FRIAs.

For SMEs, the practical implication is clear: if you build or substantially modify a high-risk AI system, you need Article 9 documentation. If you deploy a high-risk AI system in an Annex III use case, you need an Article 27 FRIA. Many organizations hold both roles simultaneously.

When an impact assessment is required

An AI impact assessment is required when:

• Your AI system is classified as high-risk under Annex III (employment, education, essential services, safety components, biometrics, law enforcement, migration, justice, democratic processes).
• You act as a provider placing a high-risk system on the EU market or putting it into service.
• You act as a deployer using a high-risk Annex III system in your operations.
• You are a deployer that is a body governed by public law, or a private entity providing public services.
• Your system undergoes a substantial modification that changes its risk profile.

If you are unsure about your role, ClearAct's Provider or Deployer Checker can help you determine which obligations apply. For risk classification, the Risk Assessment Quiz provides a scored evaluation in under five minutes.

AI impact assessment template: 10 key elements

The following template structure covers both Article 9 risk management and Article 27 FRIA requirements. SMEs should adapt depth and detail based on their system's risk level and operational context.

1. System description and intended purpose

Document the AI system's functionality, intended purpose, and operational context. Include:

• System name, version, and provider information.
• Technical architecture summary (model type, training approach, deployment method).
• Intended use cases and intended users.
• Geographical scope and affected population.
• Integration points with existing business processes.

This section establishes the factual basis for every subsequent assessment element.

2. Risk classification rationale

Record why the system is classified at its current risk level. Reference:

• Applicable Annex III category (if high-risk).
• Whether the system is a safety component of a product covered by EU harmonised legislation.
• Decision chain: who classified, when, based on what evidence.
• Any borderline classification considerations and how they were resolved.

Classification without documented rationale is one of the most common audit findings.

3. Data governance review

Assess data practices across the system lifecycle:

• Training, validation, and testing data sources and their relevance.
• Data quality metrics and gap analysis.
• Personal data processing and GDPR alignment.
• Representativeness of data relative to intended deployment context.
• Data retention and deletion policies.

Under Article 10, providers must implement data governance practices that are appropriate for the system's intended purpose.

4. Bias and discrimination risk analysis

Evaluate potential for unfair outcomes:

• Protected characteristics relevant to the use context (gender, ethnicity, age, disability, religion).
• Known bias sources in training data or model architecture.
• Proxy variable analysis (seemingly neutral features that correlate with protected characteristics).
• Subgroup performance analysis where feasible.
• Historical decision pattern review in the operational domain.

This element directly supports both Article 9 risk identification and Article 27 fundamental rights analysis.

5. Human oversight measures

Document oversight design and operational readiness:

• Who has oversight authority and what qualifications they hold.
• Override and intervention mechanisms available.
• Decision review workflows for consequential outputs.
• Escalation procedures for edge cases or system anomalies.
• Training provided to oversight personnel.

Article 14 requires that high-risk AI systems be designed to allow effective human oversight. The assessment should verify that oversight is operational, not just designed.

6. Transparency and information provisions

Describe how affected persons and users receive information:

• Instructions for use provided with the system.
• Disclosure to affected persons that they are subject to AI-assisted decisions.
• Explanation of system logic at an appropriate level of detail.
• Channels for affected persons to request human review.
• Compliance with sector-specific transparency requirements.

7. Accuracy, robustness, and cybersecurity

Assess technical reliability:

• Accuracy metrics relevant to the intended purpose.
• Performance under adversarial conditions or degraded inputs.
• Resilience to errors, faults, and inconsistencies.
• Cybersecurity measures protecting system integrity.
• Fallback procedures when system performance drops below acceptable thresholds.

8. Fundamental rights impact

For deployers conducting an Article 27 FRIA, assess impact on:

• Right to non-discrimination and equality.
• Right to privacy and data protection.
• Right to human dignity.
• Rights of the child (if minors are in the affected population).
• Right to an effective remedy and fair trial.
• Freedom of expression and information.
• Right to education and work.
• Consumer protection.

Score each right for severity and likelihood of adverse impact. Document the reasoning, not just the score.

9. Mitigation measures

For every medium or high risk identified, document:

• Specific mitigation control.
• Responsible owner and implementation deadline.
• Validation criteria (how you will know the mitigation works).
• Residual risk after mitigation.
• Escalation path if mitigation proves insufficient.

Mitigations without owners, deadlines, and validation criteria fail audit scrutiny.

10. Monitoring plan

Define ongoing monitoring commitments:

• Key performance indicators for accuracy, fairness, and reliability.
• Monitoring frequency and review cadence.
• Incident detection and response procedures.
• Post-market monitoring obligations (for providers under Article 72).
• Reassessment triggers: model update, scope change, regulatory guidance, incident occurrence.

Common mistakes SMEs make

Treating the assessment as a one-time document. The EU AI Act requires continuous risk management. An assessment completed at launch and never updated will not satisfy regulatory expectations.

Copying generic templates without system-specific evidence. Regulators and auditors look for evidence that the assessment reflects actual system behavior, real deployment context, and genuine risk analysis. Boilerplate language with no operational detail is a red flag.

Confusing provider and deployer obligations. An SME deploying a vendor's AI system cannot rely solely on the vendor's risk management. Article 27 imposes independent obligations on deployers to assess fundamental rights impact in their specific deployment context.

Ignoring indirect AI exposure. Many SMEs use AI through third-party SaaS tools (recruitment platforms, credit scoring APIs, customer service chatbots). If these tools make or influence consequential decisions, the deployer obligation still applies.

No stakeholder input. Impact assessments conducted entirely by the compliance team without input from affected operational teams, end users, or subject-matter experts tend to miss practical risk pathways.

Skipping reassessment triggers. The assessment should define when it must be revisited. Without explicit triggers, reassessment gets deprioritized until an incident forces it.

How to structure the document

A practical AI impact assessment document for SMEs should follow this format:

1. Cover page — system name, assessment date, version, assessor, approval sign-off.
2. Executive summary — one-page overview of system purpose, risk classification, and key findings.
3. Assessment body — the 10 elements above, each as a separate section with evidence references.
4. Risk register — consolidated table of identified risks with severity, likelihood, mitigation, owner, and status.
5. Appendices — supporting evidence (data quality reports, testing results, stakeholder consultation logs, technical documentation excerpts).
6. Review schedule — next assessment date, reassessment triggers, responsible reviewer.

Keep it concise but evidence-backed. A 15-page assessment with traceable evidence is worth more than a 60-page document filled with regulatory text quotations.

Next steps

ClearAct provides tools to accelerate impact assessment work:

• FRIA Wizard — guided 5-step process for completing a Fundamental Rights Impact Assessment (Article 27). Available to Pro subscribers.
• Compliance Templates — downloadable document templates for risk management, data governance, human oversight, and other compliance categories.
• Risk Assessment Quiz — free tool to determine your AI system's risk classification in under five minutes.

ClearAct Pro subscribers also get access to AI-generated compliance reports. The AI agent analyzes your system details against EU AI Act requirements and produces a personalized impact assessment report, covering risk classification rationale, applicable obligations, and recommended mitigation measures. Each report is generated using RAG-enhanced analysis of the full EU AI Act text.

Final takeaway

AI impact assessments under the EU AI Act are not academic exercises. They are operational governance instruments that connect legal obligations to engineering controls and business processes. SMEs that invest in structured, evidence-backed assessments early will reduce enforcement risk, strengthen procurement positioning, and build AI operations that are both compliant and resilient. Start with classification, build the evidence, assign ownership, and plan for reassessment. The template above gives you a framework; your system-specific context makes it defensible.