Stage 3: Assess risk and impact | ClearPath AI Governance

What this stage is for

Match the effort to the risk. Screen each system against written criteria, work out which rules apply in each region, and for higher-risk uses assess the impact on the people affected. A short, consistent assessment beats a long one done once.

Who is involved

Product owner, AI governance lead, Legal, Privacy, Risk and compliance.

Key outputs: Screening result, applicability record, impact assessment.

Step-by-step tasks

Tick each task as you complete it. Your ticks stay in this browser tab unless you export your workspace.

Run the screening check for each system and record the tier.
List which laws and frameworks are likely to apply in each region where the system is built, sold or used.
For possibly high-risk systems, assess impact on the people and groups affected, including vulnerable groups.
Record each risk with likelihood, severity, mitigation and residual risk.
Get the accountable person to accept or reject residual risk in writing.

Region callouts

Shown for the regions in My regions (header). The region pages are never hidden.

Screen against the EU AI Act's four tiers. Some deployers of high-risk systems, such as public bodies, must assess impact on fundamental rights before use. European Union page

Some state laws require risk or impact assessments for automated decisions about people (for example California and Colorado, from 2027). These dates are not settled. United States page

Run data protection impact assessments where personal data is used in AI, and check outcomes against the Equality Act. United Kingdom page

Plan for DPDP duties as they phase in, and for extra duties if you are designated a Significant Data Fiduciary. India page

Tools and templates

Tools

EU risk screening: Screen one system against the EU AI Act risk tiers.
Applicability checker: Which laws and frameworks apply to one system, and why.
Impact assessment builder: A structured assessment with region annexes.
AI risk register: Organization-wide AI risks with a risk library.
Law explorer (EU AI Act key articles): The EU AI Act article by article.

Templates

AI data protection impact assessment (EU and UK GDPR oriented): MD, DOCX
AI impact assessment: MD, DOCX
AI risk register with starter risk library (5 x 5 scoring): XLSX, CSV, DOCX
Risk assessment form: MD, DOCX
All templates for every stage

Common mistakes

Answering 'No' to keep the result low when unsure.
Assessing the model but not the people it affects.
Never re-running the assessment when the purpose changes.

You're done when…

Every system has a tier and a recorded reason.
Higher-risk systems have an impact assessment.
Residual risk is accepted by a named person.

Reviewed 3 Oct 2026.

← Stage 2: Inventory and intake · Stage 4: Design controls and document →