What an auditor, or Sekit's evidence engine, asks for.
AI system impact assessment
The procedure for assessing an AI system's impact before you use it and whenever it changes materially, plus the assessments already done: who it could affect, what risks and wider effects it has, and who approved the decision.
From the Sekit evidence catalog
In practice
Once an assessment is done, it has to survive contact with an auditor a year later: the assumptions made, who was consulted, what risks were found, what mitigations were agreed and who approved it, all versioned. A common failure is an impact assessment written once at launch and never revisited when the AI vendor changed its model or the company started feeding it a new data set. Auditors ask to see the assessment for a specific system and check the version history matches the system's actual change history.
Common gaps
The impact assessment for an AI tool was written once at adoption and never updated after a vendor model change.
Approvals are verbal or in an email thread rather than recorded against the specific version of the assessment.
Mitigations listed in the assessment were never checked afterward to confirm they were implemented as agreed.
Questions your auditor will ask
Can you show the version history of an AI impact assessment?
Yes, each material change produces a new dated version, retained alongside the earlier ones rather than overwriting them.
Who approved this specific assessment and where is that recorded?
The approver's name and decision are recorded in the assessment record itself, not in a separate untracked message.
What happens to the mitigations listed in an assessment?
Each mitigation is tracked to completion and evidenced, the same way any other control evidence is filed and reviewed.
How far back do your retained assessments go?
As far back as the AI system has been in use, with a complete record for the current and prior versions.
Where regulation demands it
GDPR Article 5.2 accountability requires the controller to demonstrate compliance, which a versioned, retained assessment is built to prove.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.