AI impact assessment template, matched to the laws that require one.
An AI impact assessment is a written review of what an AI system does, the data it uses, who it affects, what can go wrong and how you will watch it after launch. A handful of enacted laws require one for specific systems; many more organizations write one because it is the fastest way to show customers, auditors and regulators that a system was thought through. This template follows the elements those laws name, and under each section it lists the duties that ask for it, read from the official text.
Written by AI Laws by State34 duties from 11 enacted laws in 7 jurisdictionsLaws last checked November 15, 2026How we verifyInformation, not legal advice
Organizations using AI to make or shape decisions with legal or similarly significant effects on people, such as lending, housing, insurance, employment, education or health care.
Employers and staffing agencies using automated tools to screen candidates or employees in New York City, which requires an annual bias audit.
Online services likely to be used by children in Maryland, and companion chatbot operators that allow children in California.
Developers of very large frontier models, which must assess and report catastrophic risk in California, New York and Illinois.
Timing: Colorado's AI Act required deployers of high-risk AI systems to complete impact assessments from June 30, 2026. Its replacement, SB 26-189, takes over on January 1, 2027 and contains no impact-assessment duty; it relies on notices, explanations of adverse decisions, human review and three-year records instead. Colorado duties drop off this page automatically after December 31, 2026.
The template
Complete one assessment per AI system, and redo it at least yearly and before any substantial change. Under each section, open the list to see the enacted laws that ask for it.
AI Impact Assessment[Company] · Version [1.0] · Effective [date]
1. System and ownership
Identifies exactly what is being assessed, so the assessment can be matched to a version and redone when the system changes.
System name and versionThe name your team uses, the vendor product name if different, and the version or model identifier assessed.
Developer or vendorWho built the model or tool. Note whether you customized, fine-tuned or configured it.
Business ownerThe person accountable for the system's use and for acting on this assessment.
Assessment date and assessorsWho took part: business owner, technical lead, legal or privacy, and anyone independent of the team that built it.
Reason for this assessmentNew system, substantial modification, scheduled annual review, or a request from a regulator or customer.
3 enacted duties this section has to account for
When triggeredCalifornia companion chatbot children's safety law (SB 1119, Adam's Law) Operator: Before releasing a new or substantially modified companion chatbot, perform and document a risk assessment for child users and take documented measures that reasonably mitigate identified child safety risks.
Applies when: Operators that allow child users. One assessment may cover comparable chatbots; an assessment done for another law may qualify. · Bus. & Prof. Code § 21812(a)
Starts June 30, 2026Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer: Complete an impact assessment for each high-risk AI system deployed on or after June 30, 2026, then annually and within 90 days of a substantial modification; keep records three years.
Applies when: Deployer of a high-risk AI system deployed on or after June 30, 2026, unless the small-deployer exemption applies. · C.R.S. 6-1-1703(3)(a)(I), (3)(a)(II), (3)(f)
Laws that require assessments start here: what the system is for, where it will be used and what it is not meant to do.
PurposeThe problem the system solves and the benefit expected, in one or two sentences.
Intended use cases and settingWhere, by whom and for which decisions or tasks it will be used.
Uses that are out of scopeForeseeable uses the system is not designed or approved for, and how you prevent them.
Alternatives consideredThe process before the system, and why AI was chosen.
5 enacted duties this section has to account for
When triggeredCalifornia clinical decision support bias law (SB 503) Developer: Give deployers a statement of intended uses and risks, plus documentation on training data, evaluation, data governance, expected outputs, bias risks and recommended use and monitoring.
Applies when: On request or at the initial sale, whichever is earlier, and on release of material updates. Recognized industry standards or impact assessments may be used. · Bus. & Prof. Code § 22758(a)(3)-(5)
Starts January 1, 2027Colorado automated decision-making technology law (SB 26-189) Developer: Give each deployer documentation: intended and known harmful uses, categories of training data, known limitations, instructions for use, monitoring and human review, and information the deployer needs for its disclosures.
Applies when: A covered ADMT marketed, configured, contracted, sold or licensed to materially influence a consequential decision. The deployer must be told if information is withheld. · C.R.S. 6-1-1702(1), (3), (5)
Starts January 1, 2028Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions Controller: Conduct an impact assessment covering purpose and use cases, risks and mitigation, input data and outputs, customization data, performance metrics and limits, transparency measures, and post-deployment monitoring.
Applies when: The controller engages in profiling for decisions that produce a legal or similarly significant effect. Elements are required to the extent reasonably known or available. · 9 V.S.A. § 2415g(c)
3. Decisions and people affected
The heaviest duties attach when AI makes or substantially shapes decisions about people, and when children are involved.
Decisions the system makes or influencesFor example: whether to interview, approve a loan, set a price, deny a claim or show content. Say whether a person makes the final call.
Significance of the decisionDoes it affect access to employment, credit, housing, insurance, education, health care, legal services or essential goods? If so, mark it high impact.
People affectedCustomers, applicants, employees, patients, students, the public. Note whether children are likely users.
Where they areStates and cities where affected people live or apply; this decides which laws apply.
Starts January 1, 2028Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions Controller: Conduct and document a data protection assessment for processing that presents a heightened risk of harm, including profiling with the listed foreseeable risks.
Applies when: Profiling presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial, physical or reputational injury, intrusion upon seclusion or other substantial injury. Applies to processing created or generated after January 1, 2028. · 9 V.S.A. § 2415g(a)(3), (e)(3)
4. Data: inputs, outputs and training
Regulators ask what goes into the system, what comes out, and what data shaped it.
Input dataEach category of data the system receives, its source, and whether it includes personal or sensitive data (health, biometrics, precise location, children's data).
OutputsScores, classifications, generated text or media, recommendations. Who sees them and what they are used for.
Training and customization dataWhat the vendor discloses about training data, and any data you used to fine-tune, configure or ground the system.
Retention and accessHow long inputs and outputs are kept, who can access them, and whether the vendor may use them to train.
4 enacted duties this section has to account for
Starts January 1, 2027Colorado automated decision-making technology law (SB 26-189) Developer: Give each deployer documentation: intended and known harmful uses, categories of training data, known limitations, instructions for use, monitoring and human review, and information the deployer needs for its disclosures.
Applies when: A covered ADMT marketed, configured, contracted, sold or licensed to materially influence a consequential decision. The deployer must be told if information is withheld. · C.R.S. 6-1-1702(1), (3), (5)
Starts January 1, 2028Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions Controller: Conduct an impact assessment covering purpose and use cases, risks and mitigation, input data and outputs, customization data, performance metrics and limits, transparency measures, and post-deployment monitoring.
Applies when: The controller engages in profiling for decisions that produce a legal or similarly significant effect. Elements are required to the extent reasonably known or available. · 9 V.S.A. § 2415g(c)
5. Risks and how you reduce them
The core of every assessment: what could go wrong for the people affected, and what you do about it.
Discrimination and disparate impactCould results differ by race, sex, age, disability or another protected characteristic? How was this tested, and with what result?
Accuracy and errorsWhat a wrong output looks like here and what it costs the person affected.
Privacy and securityExposure of personal data, prompt injection, data leakage to vendors, unauthorized access.
Safety and childrenHarmful content, self-harm, engagement-extending design, contact with adults, for products children may use.
MitigationsFor each risk: the control, who owns it, and the residual risk you accept.
7 enacted duties this section has to account for
When triggeredCalifornia companion chatbot children's safety law (SB 1119, Adam's Law) Operator: Before releasing a new or substantially modified companion chatbot, perform and document a risk assessment for child users and take documented measures that reasonably mitigate identified child safety risks.
Applies when: Operators that allow child users. One assessment may cover comparable chatbots; an assessment done for another law may qualify. · Bus. & Prof. Code § 21812(a)
Starts June 30, 2026Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer: Implement a risk management policy and program for high-risk AI systems, reasonable in light of the NIST AI Risk Management Framework, ISO/IEC 42001 or an equivalent framework, and reviewed regularly.
Applies when: Deployer of a high-risk AI system, on and after June 30, 2026, unless the small-deployer exemption in 6-1-1703(6) applies. · C.R.S. 6-1-1703(2)
Starts January 1, 2028Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions Controller: Conduct and document a data protection assessment for processing that presents a heightened risk of harm, including profiling with the listed foreseeable risks.
Applies when: Profiling presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial, physical or reputational injury, intrusion upon seclusion or other substantial injury. Applies to processing created or generated after January 1, 2028. · 9 V.S.A. § 2415g(a)(3), (e)(3)
Starts January 1, 2028Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions Controller: Conduct an impact assessment covering purpose and use cases, risks and mitigation, input data and outputs, customization data, performance metrics and limits, transparency measures, and post-deployment monitoring.
Applies when: The controller engages in profiling for decisions that produce a legal or similarly significant effect. Elements are required to the extent reasonably known or available. · 9 V.S.A. § 2415g(c)
6. Performance and known limits
Shows the system works for its purpose, and where it does not.
MetricsAccuracy, error rates, selection rates or impact ratios by group, latency. Say how and when they were measured.
Known limitationsPopulations, languages, inputs or conditions where the system performs worse or should not be used.
Independent testingAny bias audit, red-team or third-party evaluation, with date and who performed it.
Starts January 1, 2023New York City automated employment decision tools law (Local Law 144 of 2021) Employer or employment agency: Make a summary of the most recent bias audit results and the distribution date of the tool publicly available on its website before using the tool.
Applies when: The tool is used to screen a candidate or employee for an employment decision in the city. · Admin. Code § 20-871(a)(2)
Starts January 1, 2028Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions Controller: Conduct an impact assessment covering purpose and use cases, risks and mitigation, input data and outputs, customization data, performance metrics and limits, transparency measures, and post-deployment monitoring.
Applies when: The controller engages in profiling for decisions that produce a legal or similarly significant effect. Elements are required to the extent reasonably known or available. · 9 V.S.A. § 2415g(c)
7. Transparency to the people affected
Most AI laws in force today are disclosure laws: telling people AI is involved, and explaining adverse decisions.
Notice before useHow and when people are told AI is used, in which channel and language.
Explanation after an adverse decisionWhat you tell someone who is denied or disadvantaged, and how quickly.
Public statementsWebsite notices, published audit summaries, privacy notice language.
6 enacted duties this section has to account for
Starts January 1, 2027Colorado automated decision-making technology law (SB 26-189) Deployer: Before using a covered ADMT in a consequential decision, give the consumer clear and conspicuous notice of that use and instructions for getting more information.
Applies when: Any consequential decision materially influenced by a covered ADMT. A prominent public notice reasonably accessible at the point of interaction satisfies this. · C.R.S. 6-1-1704(1), (2)
When triggeredColorado automated decision-making technology law (SB 26-189) Deployer: Within 30 days of an adverse decision, give a plain-language description of the decision and the ADMT's role, a process to request more information, and an explanation of consumer rights.
Applies when: When a covered ADMT materially influences a consequential decision with an adverse outcome for the consumer. · C.R.S. 6-1-1704(3)
Starts January 1, 2023New York City automated employment decision tools law (Local Law 144 of 2021) Employer or employment agency: Make a summary of the most recent bias audit results and the distribution date of the tool publicly available on its website before using the tool.
Applies when: The tool is used to screen a candidate or employee for an employment decision in the city. · Admin. Code § 20-871(a)(2)
When triggeredNew York City automated employment decision tools law (Local Law 144 of 2021) Employer or employment agency: Notify each such candidate or employee, at least 10 business days before use, of the job qualifications and characteristics the tool will use in its assessment.
Applies when: An automated employment decision tool will be used to assess or evaluate a city resident who applied for a position. · Admin. Code § 20-871(b)(2)
Starts January 1, 2028Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions Controller: Conduct an impact assessment covering purpose and use cases, risks and mitigation, input data and outputs, customization data, performance metrics and limits, transparency measures, and post-deployment monitoring.
Applies when: The controller engages in profiling for decisions that produce a legal or similarly significant effect. Elements are required to the extent reasonably known or available. · 9 V.S.A. § 2415g(c)
8. Human oversight and appeals
Who can step in, and how an affected person can question the result.
Human reviewWhich outputs a person reviews before they take effect, and that person's authority to overrule.
Correction and appealHow someone can correct their data, ask why, and get a human to reconsider.
Stop conditionsWho can suspend the system, and what would trigger it.
2 enacted duties this section has to account for
When triggeredColorado automated decision-making technology law (SB 26-189) Deployer: On request after an adverse outcome, give instructions for requesting and correcting personal data, and an opportunity for meaningful human review and reconsideration to the extent commercially reasonable.
Applies when: When the consumer asks. Opinions, predictions, scores and protected evaluations need not be corrected. · C.R.S. 6-1-1705(1)
Starts June 30, 2026Colorado Artificial Intelligence ActEnds December 31, 2026 Deployer: Complete an impact assessment for each high-risk AI system deployed on or after June 30, 2026, then annually and within 90 days of a substantial modification; keep records three years.
Applies when: Deployer of a high-risk AI system deployed on or after June 30, 2026, unless the small-deployer exemption applies. · C.R.S. 6-1-1703(3)(a)(I), (3)(a)(II), (3)(f)
Starts January 1, 2028Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions Controller: Conduct an impact assessment covering purpose and use cases, risks and mitigation, input data and outputs, customization data, performance metrics and limits, transparency measures, and post-deployment monitoring.
Applies when: The controller engages in profiling for decisions that produce a legal or similarly significant effect. Elements are required to the extent reasonably known or available. · 9 V.S.A. § 2415g(c)
10. Records and sign-off
Several laws require you to keep assessments and hand them over on request, sometimes within days.
ApprovalName, role and date of the person approving the system for use, with any conditions.
Where this is stored and for how longKeep it at least as long as any applicable law requires; three years is common.
Who can produce it on requestName the person who answers a regulator's or customer's request.
7 enacted duties this section has to account for
When triggeredCalifornia companion chatbot children's safety law (SB 1119, Adam's Law) Operator: Send the Attorney General an attested summary of each audit within 30 business days, and post a high-level summary on its website within 90 days.
Applies when: After receiving each independent audit report. The full report must be given to the Attorney General within 30 business days of a for-cause request. · Bus. & Prof. Code § 21814(b), (d)
When triggeredColorado Artificial Intelligence ActEnds December 31, 2026 Developer or deployer: Produce the required statements, documentation, risk policy, impact assessments or records to the attorney general within 90 days of a request.
Applies when: On the attorney general's request. · C.R.S. 6-1-1702(7); 6-1-1703(9)
Frontier model developers: catastrophic-risk assessments
These apply only to developers of the largest frontier models, not to organizations using AI.
When triggeredCalifornia: Transparency in Frontier Artificial Intelligence Act (TFAIA) Large frontier developer: Include in the transparency report summaries of catastrophic-risk assessments, their results, third-party evaluator involvement and other steps taken under the framework.
Applies when: Each deployment of a new or substantially modified frontier model by a large frontier developer. · Bus. & Prof. Code § 22757.12(c)(2)
Starts January 1, 2026California: Transparency in Frontier Artificial Intelligence Act (TFAIA) Large frontier developer: Send the Office of Emergency Services a summary of any assessment of catastrophic risk from internal use of its frontier models every three months.
Applies when: Or on another reasonable schedule the developer specifies in writing to the Office, with written updates as appropriate. · Bus. & Prof. Code § 22757.12(d)
Starts January 1, 2028Illinois Artificial Intelligence Safety Measures Act Large frontier developer: Write, implement, comply with and publish on its website a frontier AI framework covering ten listed topics, including capability thresholds, mitigations, third-party assessment, model-weight cybersecurity and incident response.
Applies when: A frontier developer whose annual gross revenues, with affiliates, exceeded $500,000,000 in the preceding calendar year. · Public Act 104-0538, Section 10(a)
Starts January 1, 2027Illinois Artificial Intelligence Safety Measures Act Large frontier developer: Add to each transparency report machine-readable summaries of catastrophic risk assessments, their results, third-party evaluator involvement and other steps taken under the framework.
Applies when: Before or at the same time as deploying a new or substantially modified frontier model. · Public Act 104-0538, Section 10(c)(2), (3)
Starts January 1, 2028Illinois Artificial Intelligence Safety Measures Act Large frontier developer: Retain an independent third party each year to audit compliance with Section 10, with no financial interest between them and no payment tied to results.
Applies when: Beginning January 1, 2028, or 90 days after first becoming a large frontier developer, whichever is later. · Public Act 104-0538, Section 10(d)
Starts January 1, 2027Illinois Artificial Intelligence Safety Measures Act Large frontier developer: Send the Agency a summary of catastrophic risk assessments from internal use of its frontier models every 3 months.
Applies when: Internal use of frontier models. Another schedule may be used if communicated in writing and agreed with the Agency. · Public Act 104-0538, Section 10(e)
When triggeredNew York RAISE Act (Responsible AI Safety and Education Act) Large frontier developer: In the transparency report, also summarize catastrophic-risk assessments, their results, third-party involvement and other framework steps taken.
Applies when: Each deployment of a new or substantially modified frontier model by a large frontier developer, from January 1, 2027. · GBL § 1421(3)(b)
Starts January 1, 2027New York RAISE Act (Responsible AI Safety and Education Act) Large frontier developer: Send the Department of Financial Services office a summary of catastrophic-risk assessments from internal use of frontier models every three months, or on another agreed schedule.
Applies when: Large frontier developer, from January 1, 2027. · GBL § 1422(2)(a)
Get it as a Word file
Pro members download this template as an editable Word file with the law list under each section, ready for Word, Google Docs or Pages. Pro also includes the downloadable compliance plan and deadline calendar, per-bill alerts and saved searches.
Only for specific systems and organizations. New York City requires a bias audit no more than a year old before an automated hiring tool is used. Maryland requires data protection impact assessments for online products reasonably likely to be used by children. From July 1, 2027, California requires a documented child-safety risk assessment before releasing a companion chatbot that allows children, and from January 1, 2028, Vermont requires impact assessments for profiling that drives decisions with legal or similarly significant effects. Colorado's requirement for high-risk AI systems ends on December 31, 2026. Each requirement is listed on this page with its section of law.
What should an AI impact assessment include?
At minimum: the system's purpose and intended uses, the decisions and people it affects, its input data, outputs and training or customization data, the risks and how you reduce them, performance metrics and limits, how you inform affected people, human oversight and appeals, post-launch monitoring, and who approved it. Vermont's law lists most of these elements by name.
How often should it be updated?
At least once a year and before any substantial change to the system, its data or how it is used. Maryland requires a review within 90 days of a material change, and New York City's bias audit must be no more than one year old when the tool is used.
Is a bias audit the same as an impact assessment?
No. A bias audit is a statistical test of outcomes across groups, which New York City requires for automated hiring tools. An impact assessment is broader and covers purpose, data, risks, transparency and oversight. Section 6 of this template is where bias audit results go.
Can I use this template as is?
It is a starting point. It follows the elements the laws name, but it does not decide which laws apply to you, and some laws set their own required format or content. Check the section of law linked under each heading, and have a lawyer review the finished assessment.
Get an email when AI bills in your state change
Following AI compliance legislation? Pick your state and we’ll email you when its AI bills are introduced or change status (at most one alert email a day), plus our weekly digest. Choose “All states” for the weekly digest only.
We’ll send a confirmation link first; nothing else is sent until you confirm. Unsubscribe anytime. See past weekly issues. Need alerts for specific bills only? Per-bill alerts come with Pro.
Information, not legal advice. This template is a starting point written by AI Laws by State. It does not decide whether any law applies to your organization; that depends on facts such as where you operate, your size, your industry and how you use AI. The laws listed are summarized from their official texts, which are linked; laws change, and courts and regulators can read them differently. Have a qualified lawyer review your final document. Using this page does not create an attorney-client relationship. See our terms of service.
AI Impact Assessment
1. System and ownership
System name and version:
[The name your team uses, the vendor product name if different, and the version or model identifier assessed.]
Developer or vendor:
[Who built the model or tool. Note whether you customized, fine-tuned or configured it.]
Business owner:
[The person accountable for the system's use and for acting on this assessment.]
Assessment date and assessors:
[Who took part: business owner, technical lead, legal or privacy, and anyone independent of the team that built it.]
Reason for this assessment:
[New system, substantial modification, scheduled annual review, or a request from a regulator or customer.]
2. Purpose and intended uses
Purpose:
[The problem the system solves and the benefit expected, in one or two sentences.]
Intended use cases and setting:
[Where, by whom and for which decisions or tasks it will be used.]
Uses that are out of scope:
[Foreseeable uses the system is not designed or approved for, and how you prevent them.]
Alternatives considered:
[The process before the system, and why AI was chosen.]
3. Decisions and people affected
Decisions the system makes or influences:
[For example: whether to interview, approve a loan, set a price, deny a claim or show content. Say whether a person makes the final call.]
Significance of the decision:
[Does it affect access to employment, credit, housing, insurance, education, health care, legal services or essential goods? If so, mark it high impact.]
People affected:
[Customers, applicants, employees, patients, students, the public. Note whether children are likely users.]
Where they are:
[States and cities where affected people live or apply; this decides which laws apply.]
4. Data: inputs, outputs and training
Input data:
[Each category of data the system receives, its source, and whether it includes personal or sensitive data (health, biometrics, precise location, children's data).]
Outputs:
[Scores, classifications, generated text or media, recommendations. Who sees them and what they are used for.]
Training and customization data:
[What the vendor discloses about training data, and any data you used to fine-tune, configure or ground the system.]
Retention and access:
[How long inputs and outputs are kept, who can access them, and whether the vendor may use them to train.]
5. Risks and how you reduce them
Discrimination and disparate impact:
[Could results differ by race, sex, age, disability or another protected characteristic? How was this tested, and with what result?]
Accuracy and errors:
[What a wrong output looks like here and what it costs the person affected.]
Privacy and security:
[Exposure of personal data, prompt injection, data leakage to vendors, unauthorized access.]
Safety and children:
[Harmful content, self-harm, engagement-extending design, contact with adults, for products children may use.]
Mitigations:
[For each risk: the control, who owns it, and the residual risk you accept.]
6. Performance and known limits
Metrics:
[Accuracy, error rates, selection rates or impact ratios by group, latency. Say how and when they were measured.]
Known limitations:
[Populations, languages, inputs or conditions where the system performs worse or should not be used.]
Independent testing:
[Any bias audit, red-team or third-party evaluation, with date and who performed it.]
7. Transparency to the people affected
Notice before use:
[How and when people are told AI is used, in which channel and language.]
Explanation after an adverse decision:
[What you tell someone who is denied or disadvantaged, and how quickly.]
Public statements:
[Website notices, published audit summaries, privacy notice language.]
8. Human oversight and appeals
Human review:
[Which outputs a person reviews before they take effect, and that person's authority to overrule.]
Correction and appeal:
[How someone can correct their data, ask why, and get a human to reconsider.]
Stop conditions:
[Who can suspend the system, and what would trigger it.]
9. Monitoring after launch
What you monitor:
[Drift in accuracy or outcomes by group, complaints, incidents, vendor changes.]
Review schedule:
[At least annually, and before any substantial modification goes live.]
Triggers for a new assessment:
[New use case, new data source, model or vendor change, new state or city of operation.]
10. Records and sign-off
Approval:
[Name, role and date of the person approving the system for use, with any conditions.]
Where this is stored and for how long:
[Keep it at least as long as any applicable law requires; three years is common.]
Who can produce it on request:
[Name the person who answers a regulator's or customer's request.]
Template by AI Laws by State (ailawsbystate.com). Information, not legal advice.
We use cookies for analytics to understand how visitors use this site. We also use essential cookies for site functionality.
See our Privacy Policy for details.