AI System Impact Assessment (AIIA)

Legislation checked · 26 June 2026 Not yet advocate-reviewed Execution steps not yet documented

Drafted by:: Lekha editorial team
Version:: v0.1
Last checked against current law:: 15 May 2026
Next scheduled review:: 15 November 2026

Statutory sources (4)

Digital Personal Data Protection Act, 2023Official statuteofficial source
Indian Contract Act, 1872Official statuteofficial source
Code of Civil Procedure, 1908Official statuteofficial source
Arbitration and Conciliation Act, 1996Official statuteofficial source

These badges show which checks this document has passed. They are not a judgment of whether it is legally valid or right for your situation — for a high-stakes matter, have an advocate review it →

After you download

Fill every [BRACKETED PLACEHOLDER] before signing — open the downloaded file and search for "[" to catch any you missed.
Check stamp duty for your state — many Indian documents are only enforceable on adequate stamp paper or e-stamp; the amount varies by state and document type.
Sign as required — check whether the document needs witnesses, and whether all parties must initial each page.
Check registration — some documents (e.g. certain leases, gift deeds) must be registered with the Sub-Registrar to be fully effective.
Keep signed originals safe and give every party a copy; note any filing, renewal, or compliance deadlines the document creates.

Generic checklist — document-specific stamping and filing steps for this template are being documented.

Generate a AI System Impact Assessment (AIIA) for India, free. AI System Impact Assessment record aligned with ISO/IEC 42001:2023 (Clauses 6.1.4 and 8.4) and ISO/IEC 42005:2025 guidance. Documents system description, intended purpose, affected individuals and groups, potential harms (bias, safety, privacy, security, transparency, autonomy, environmental), likelihood and severity, mitigations, human oversight, residual impact and the acceptability decision. Supports EU AI Act fundamental-rights and conformity context. Fill a guided online form and download as PDF or DOCX — no signup, no watermark, no cost.

✅ Free, no signup

Generate and download with no account and no payment.

⬇ DOCX & PDF

Download as PDF / DOCX.

🇮🇳 India-first

Follows Indian legal conventions and state rules.

Frequently asked questions

Is the AI System Impact Assessment (AIIA) free to use?

Yes. Lekha is completely free — generate and download your AI System Impact Assessment (AIIA) with no payment and no account required.

What format do I get?

You can download the AI System Impact Assessment (AIIA) as PDF, DOCX.

Is this AI System Impact Assessment (AIIA) valid in India?

The template follows India legal conventions. For high-stakes matters, have it reviewed by a qualified lawyer — Lekha lists verified advocates for free.

Organisation & system

Organisation / company name *

AI system name / identifier *

Assessment date *

Next scheduled review date

AI lifecycle stage assessed

3 required fields left.

📋

Template verified May 2026 — checked against applicable central Acts and current state rules. Legal requirements can change; for property transactions above ₹5 lakh, employment disputes, or business agreements above ₹10 lakh, have a lawyer review it before signing →. Run Lekha Audit on any document you receive →

Attachments

Keep your letterhead, logo, or supporting documents handy while you fill the form. To analyse a document with AI, use Lekha Audit above.

Click or drag files here

Letterhead (PNG/JPG), Logo, PDFs — max 5 MB each

Live preview

0 of 3 essentials added — almost there · +9 optional

Standards & Regulatory Alignment

ISO/IEC 42001:2023 — AI Management Systems, Clause 6.1.4 (AI system impact assessment process) and Clause 8.4 (performing and retaining assessments)
ISO/IEC 42001:2023 — Annex A/B (impact-assessment controls) referenced by the AIMS
ISO/IEC 42005:2025 — AI system impact assessment (guidance, harm/benefit taxonomy, documentation)
EU AI Act (Reg. (EU) 2024/1689) — Article 27 (fundamental rights impact assessment), Article 14 (human oversight), Article 43 (conformity assessment)
Digital Personal Data Protection Act, 2023 (DPDP Act, India) — where personal data is processed

This AI System Impact Assessment (AIIA) documents the potential impacts of an AI system on individuals, groups, society and the environment, and the controls applied to keep residual impact acceptable. It records the process required by ISO/IEC 42001 Clause 6.1.4 and performed under Clause 8.4, following the guidance of ISO/IEC 42005:2025. It is a working record and a template — not legal or compliance advice, and it does not by itself establish EU AI Act conformity.

AI System
Assessment Date: [Assessment Date]
Lifecycle Stage Assessed: Pre-deployment (before go-live)
Organisation's Role: Provider / developer
Risk Classification: High-risk (EU AI Act Annex III context)
System Owner
Accountable Approver
Next Review: [Review Date]

1. Purpose and Scope of this Assessment

This AI System Impact Assessment ("AIIA") evaluates the potential impacts of the AI system "" operated by . It is prepared to satisfy the impact-assessment process defined under ISO/IEC 42001:2023 Clause 6.1.4 and is performed and documented in line with Clause 8.4, drawing on the guidance in ISO/IEC 42005:2025. The scope covers the pre-deployment (before go-live) stage of the AI lifecycle, the system's intended purpose, its reasonably foreseeable use and misuse, and the individuals, groups, society and environment that may be affected. Where the system is high-risk, this assessment also supports the fundamental-rights considerations expected under Article 27 of the EU AI Act.

2. AI System Description, Intended Purpose and Context of Use

Intended purpose: Context of use: Organisation's role: Provider / developer. Degree of automation: Human-in-the-loop — a person reviews and confirms each material output. Regulatory risk classification (as assessed): High-risk (EU AI Act Annex III context). Reasonably foreseeable misuse and out-of-scope uses shall be identified and, where material, treated as impacts in Clause 5.

3. Data and Model

Data sources and types: Model / technique: The assessment considers data provenance, quality, representativeness and lawful basis; known limitations of the model; and the conditions under which performance may degrade (e.g. distribution shift, edge cases, adversarial inputs). Where personal data is processed, this AIIA is read together with any Data Protection Impact Assessment (DPIA) rather than replacing it.

4. Affected Individuals, Groups and Society

Affected individuals and groups: Wider societal and environmental considerations: Both benefits and harms are considered. The assessment gives particular attention to groups that may be disproportionately affected and to individuals who do not interact with the system directly but are nonetheless impacted by its outputs.

5. Potential Impacts and Harms

Potential impacts are identified across the harm categories drawn from ISO/IEC 42005:2025, considering both the individual and society. Each identified impact is recorded in the impact register (Clause 7) with its likelihood, severity and treatment. The categories considered are:

6. Impact Categories Considered

(a) Bias, fairness and discrimination — unjustified differential outcomes across protected or vulnerable groups; (b) Safety and reliability — physical, psychological or financial harm from erroneous, unstable or unavailable outputs; (c) Privacy and data protection — unlawful, excessive or unexpected processing of personal data, re-identification or inference; (d) Security — model theft, data poisoning, evasion, prompt injection and misuse; (e) Transparency and explainability — inability of affected persons to understand that AI is used or why an output was produced; (f) Human autonomy and agency — over-reliance, manipulation, deskilling or erosion of meaningful human choice; (g) Environmental — energy, water and carbon footprint of training and inference; (h) Societal and rights impacts — effects on access to services, fundamental rights, and public trust.

7. Impact Register — Likelihood and Severity

For each identified impact, likelihood and severity are rated (Low / Medium / High) to derive an inherent impact level. Existing and planned mitigations are recorded, and a residual impact level is assigned after controls. This register is the operative record of the assessment:

Impact / harm	Category	Likelihood	Severity	Mitigation / control	Residual
Unjustified differential outcomes for a protected or vulnerable group	Bias & discrimination	[L/M/H]	[L/M/H]	Subgroup fairness testing; thresholds; data review	[L/M/H]
Erroneous or unavailable output causes financial / physical harm	Safety & reliability	[L/M/H]	[L/M/H]	Accuracy thresholds; fallback; human confirmation	[L/M/H]
Excessive or unexpected processing of personal data	Privacy & data protection	[L/M/H]	[L/M/H]	Data minimisation; access control; DPIA	[L/M/H]
Model manipulation, evasion, poisoning or misuse	Security	[L/M/H]	[L/M/H]	Adversarial testing; access controls; monitoring	[L/M/H]
Affected person cannot tell AI was used or why	Transparency	[L/M/H]	[L/M/H]	AI disclosure; explanation; contestation route	[L/M/H]
Over-reliance / erosion of meaningful human choice	Human autonomy	[L/M/H]	[L/M/H]	Human oversight; automation-bias training	[L/M/H]
Energy / carbon footprint of training and inference	Environmental	[L/M/H]	[L/M/H]	Efficient models; retraining cadence review	[L/M/H]

8. Mitigations and Controls

For each material impact, proportionate technical and organisational controls are applied and mapped to the impact register. Typical controls include: representative and documented training data with bias testing across subgroups; performance and fairness metrics with defined acceptance thresholds; data minimisation, access control and encryption for personal data; adversarial-robustness, model-access and secure-development controls; explainability artefacts and user-facing AI disclosure; rate limits, guardrails and out-of-scope-use restrictions; and logging sufficient to investigate incidents. Controls are owned, dated and tracked to completion before the acceptability decision in Clause 10 is relied upon.

9. Human Oversight Measures

Human oversight is implemented as: Human-in-the-loop — a person reviews and confirms each material output. In line with Article 14 of the EU AI Act and ISO/IEC 42001 operational controls, oversight measures include: (a) clearly assigned oversight roles with the authority and competence to intervene; (b) the ability to interpret outputs, recognise automation bias, and override or halt the system; (c) defined escalation paths for anomalous, low-confidence or contested outputs; (d) a documented route for affected persons to seek human review of a decision; and (e) monitoring of oversight effectiveness so that it is meaningful in practice and not merely nominal.

10. Residual Impact and Acceptability Decision

After applying the controls in Clause 8 and the oversight measures in Clause 9, the residual impact of "" has been evaluated against 's risk-acceptance criteria. Acceptability decision: ACCEPT WITH CONTROLS — proceed subject to the mitigations and conditions below. Where the decision is "accept with controls" or "defer", the associated conditions and outstanding actions are listed in the impact register and must be discharged and verified before or during deployment as specified. This decision is recorded by the accountable approver and retained as documented information under ISO/IEC 42001 Clause 8.4.

11. Review Triggers and Reassessment

This assessment is reviewed at planned intervals and whenever a significant change occurs, consistent with ISO/IEC 42001 Clause 8.4. Review triggers include: (a) a change to the intended purpose, context of use or user population; (b) material changes to data, model, or a retraining that alters behaviour; (c) observed performance drift, incidents, complaints or near-misses; (d) new or amended legal, regulatory or contractual requirements; and (e) new information about harms or affected groups. The next scheduled review is [Review Date]. An out-of-cycle review shall be performed promptly when any trigger arises.

12. Documentation, Ownership and Retention

The system owner () is responsible for maintaining this assessment and its supporting evidence. The accountable approver () owns the acceptability decision. This AIIA, its impact register, and evidence of completed controls are retained as documented information, version-controlled, and made available to internal audit and, where appropriate, to relevant interested parties and competent authorities. Superseded versions are retained to preserve the assessment history of the AI system.

This AI System Impact Assessment for "" was completed by on [Assessment Date] and reflects the assessment of record as at that date. Outcome: ACCEPT WITH CONTROLS — proceed subject to the mitigations and conditions below.

AI System Owner

Accountable Approver

Connected legal intelligence

Everything on Lekha that relates to this document — the clauses inside it, what to do next, the law to learn, and the risks to watch. Educational, not legal advice.

Clauses inside, explained

Data protection (DPDP)Definition of Confidential Information Indemnity Governing law & jurisdiction

Full clause library →

Acts this document touches

Trace each Act to the clauses and other templates connected to it.

Digital Personal Data Protection Act, 2023 Indian Contract Act, 1872 Code of Civil Procedure, 1908 Arbitration and Conciliation Act, 1996

Common risks to watch

Data protection (DPDP). Allocates responsibilities for handling personal data under Indian law.
Definition of Confidential Information. Defines exactly what information the recipient must keep secret.
Indemnity. Allocates who bears the cost if a third party brings a claim.
Governing law & jurisdiction. Fixes which State's courts and which body of law decide any dispute under the document.

Learn the law

🛡️ DPDP Act 2023 & Indian Privacy LawEverything a startup, SME, or CA needs to know about India's new data law

📖 GuidesDPDP Act 2023: what every Indian website now needs →

Applicable compliance

Track these in your organisation's compliance register.

DPDP Act 2023 readiness

Published privacy policy

Open compliance register →

Related templates

Vendor DPA Information Security Policy HIPAA Security Rule Policy HIPAA Notice of Privacy Practices (NPP)HIPAA Business Associate Agreement (BAA)HIPAA Breach Notification Policy

🤖 Ask Vidhi about this documentor use the ✨ Ask AI bubble on any page.

AI System Impact Assessment (AIIA)

After you download

Frequently asked questions

Organisation & system

📎Attachments

Connected legal intelligence

⚖️ Clauses inside, explained

🏛️ Acts this document touches

⚠️ Common risks to watch

📚 Learn the law

✅ Applicable compliance

📄 Related templates