An AI risk and impact assessment takes each AI use case through an inventory, an in-scope screen, an inherent risk rating, a deeper impact analysis, a risk treatment plan, residual risk sign-off and registration. It then continues with monitoring. The depth depends on how risky the use case is, so low-risk tools get a lighter review.
Boards, regulators and customers now expect organisations to know which AI they use, what could go wrong and who approved it. An AI risk and impact assessment is the structured way to answer those three questions for each use case.
The outcome: a defensible decision on each AI use case
The point of an assessment is not a long report. It is a record that shows a named person looked at each AI use case, understood the risks and impacts, decided what controls were needed and accepted whatever risk remained. That record is what a board, an auditor, a regulator or a major customer will ask to see.
For most mid-market organisations the practical outcome is three things: an AI register that lists every tool and use case, a risk rating for each one, and a short summary the executive or board can act on. Done well, it also helps you say yes to useful AI faster, because approved use cases have a clear path and known conditions.
Step 1: Inventory what AI is actually in use
You cannot assess what you have not found. The first step is a discovery of AI in use across the organisation. That includes AI built into software you already license, such as productivity and SaaS platforms, vendor-supplied models, and staff use of public generative AI tools that nobody formally approved.
Many organisations find this step the most revealing. Common questions at this stage are: Do we have an inventory of the AI tools our teams use? Do we know which SaaS products have switched on AI features? Is anyone using a public chatbot with customer or staff information?
The output is a register of AI use cases, ideally in a recognised template so it can be maintained over time.
Step 2: Decide what is in scope
Not every tool needs a full assessment. An in-scope determination records which items are genuinely AI use cases, which are not, and why. A spell checker and a system that helps decide who gets a loan are very different things, and the process should treat them differently.
This screen keeps the effort proportionate. It also creates a written record of the reasoning, which matters if someone later asks why a particular tool was not assessed in depth.
Step 3: Threshold assessment and inherent risk rating
For each in-scope use case, the threshold assessment describes the use case in plain language, sets out its purpose and expected benefits, and tests whether a non-AI alternative would do the job. It also maps who is affected, including customers, staff and other stakeholders.
The use case is then rated for inherent risk, meaning the risk before any controls, across a set of risk categories. A facilitated workshop is a good way to do this, because it brings the business owner, privacy, security and risk people into the same conversation. Each rating should have a written explanation, so the reasoning can be reviewed later.
This is the same shape as the DTA AI impact assessment tool used by Commonwealth entities, where the updated policy adds AI use-case registers, accountable use-case owners and AI impact assessments, with obligations phased through 2026 [2]. Private-sector organisations are not bound by that policy, but its structure is a sensible model.
Step 4: Full impact assessment for higher-risk use cases
Use cases that rate higher move to a full impact assessment. This is a detailed analysis of how the system could affect people and the organisation, tested against each AI ethics principle, with the evidence you relied on and a record of who was consulted.
Typical areas covered include privacy, security, accuracy, fairness, transparency and human oversight. The aim is to find where harm could occur, who would bear it, and whether a human can meaningfully review or override the AI's output.
Two related pieces of work often sit alongside this. A privacy impact assessment goes deeper on personal information flows. A technical security assessment or bias test examines the system itself. An AI risk and impact assessment draws on those but does not replace them.
Step 5: Treat the risks, rate what remains and sign off
The assessment then sets out a risk treatment plan: the controls that should be in place, who owns each one and by when. Controls might include limiting what data the tool can reach, requiring human review of certain outputs, updating notices, or tightening vendor terms.
After treatment, the use case is re-rated for residual risk. An accountable owner then decides whether to accept it, and that decision is recorded. For higher-risk cases this decision belongs with senior management or the board.
This is where the idea of accountable ownership matters. The risk does not sit with the tool or the vendor. It sits with a named person in your organisation.
Step 6: Register, monitor and revalidate
An assessment is a snapshot, and AI changes. Vendors update models, staff find new uses and the data feeding a system shifts. The final step is to update the register, set a monitoring approach and schedule revalidation, so the assessment stays current.
If your organisation is thinking about AI agents, the ASD Information Security Manual changes from September 2026 are worth noting. They add controls requiring each AI agent to have a unique identity and an AI agent register covering owner, purpose, credentials, tools, permissions and data reached [4]. A good register is useful for both governance and security.
Privacy and automated decision-making
Many AI use cases touch personal information. Where AI is used to make or substantially help make decisions about individuals, Australian privacy law changes mean organisations will need to explain this in their privacy policy. TFIQ's guide to the 10 December 2026 changes covers this in more detail. An assessment should flag these use cases early so the privacy work is not left to the last minute.
Regulators are paying attention to how AI affects customers. ASIC has said that for banking it will review new and proposed AI use in customer-facing activities and its impact on customers [5]. Organisations in other sectors can expect similar questions from their own regulators and customers. This article is general information, not legal advice, so get advice on how the rules apply to you.
Why speed and evidence matter
When something goes wrong, regulators look at how quickly and how well you assessed it. In the Australian Clinical Labs case, the Federal Court ordered $5.8m in penalties, including $800k for inadequate breach assessment and $800k for failing to notify promptly [1]. That case concerned a data breach rather than AI, but the lesson carries over: a documented, timely assessment is part of what regulators expect.
Similarly, the NZ Biometric Processing Privacy Code, which has applied since 3 November 2025, requires a proportionality assessment for biometric processing [3]. Proportionality thinking is at the heart of any good AI impact assessment.
What TFIQ's AI Risk and Impact Assessment looks like
TFIQ's AI Risk and Impact Assessment is an independent, evidence-based assessment of the risks and impacts of each AI use case. It runs from inventory and in-scope screening through to residual risk sign-off, registration and ongoing monitoring.
Government clients receive assessments completed in the DTA AI impact assessment tool format, with register, governance and DTA reporting content. Small-to-medium enterprises receive a right-sized, fixed-price assessment aligned to AS ISO/IEC 42005:2025, with an AI register, a risk-rated view of each tool and a board-ready summary.
The work is scoped in stages. A first screen takes about 2 weeks and covers discovery of AI tools in use, screening of up to 5 use cases against 8 risk categories, an AI register and an automated decision-making exposure check. A fuller package adds one full impact assessment, a risk treatment plan and a board briefing, over 3 to 4 weeks. Technical testing, legal advice and implementation of controls are not included.
Frequently asked questions
How long does an AI risk and impact assessment take?
It depends on how many use cases you have and how risky they are. A first screen of up to 5 use cases can take about 2 weeks. Adding a full impact assessment for one use case, with a treatment plan and board briefing, takes 3 to 4 weeks.
Do we need to assess every AI tool?
No. An in-scope screen decides which tools are genuine AI use cases and how deep to go. Low-risk tools get a light review and a register entry. Higher-risk uses get a full impact assessment.
Who should own the assessment?
An accountable owner in the business should own each AI use case and its residual risk. Privacy, security, risk and IT contribute, and an independent assessor can add rigour and evidence. Higher-risk cases usually go to senior management or the board.
How is it different from a privacy impact assessment?
A privacy impact assessment focuses on personal information and privacy law. An AI risk and impact assessment is broader, covering fairness, transparency, accuracy, oversight and other impacts. The two often complement each other.
Is it a legal requirement for private organisations?
Commonwealth entities have AI policy obligations, including impact assessments, phased through 2026 [2]. For most private organisations it is good practice rather than a standalone rule, though privacy, sector and contractual requirements may apply. Get advice for your situation.
How often should we repeat it?
Revisit it when a use case changes materially, when a vendor changes the model or features, and on a regular schedule agreed at sign-off. The register and monitoring plan keep this manageable.
Start with the AI readiness snapshot & board briefing, a fixed-fee 1 to 2 week look at where AI is already used, the risks it creates and what the board should ask for next, then move to the AI Risk and Impact Assessment.
Related: AI Governance Consultants and ISO 42001 · Privacy Impact Assessments (PIA) in Australia · Privacy Act ADM Changes: 10 December 2026 Guide · Board and Executive Assurance Reporting · Microsoft Copilot Data Risk and Readiness
Sources
- Australian Clinical Labs ordered to pay penalties in relation to Medlab Pathology data breach (OAIC)
- AI Policy overhauled with new Impact assessment tool and Procurement guidance (DTA)
- Biometric Processing Privacy Code (Office of the Privacy Commissioner NZ)
- ISM September 2026 Changes (ASD)
- 26-232MR: ASIC releases 2026-27 supervisory priorities (30 Sep 2026) (ASIC)
