What an auditor, or Sekit's evidence engine, asks for.
AI system impact assessment
The procedure for assessing an AI system's impact before you use it and whenever it changes materially, plus the assessments already done: who it could affect, what risks and wider effects it has, and who approved the decision.
From the Sekit evidence catalog
In practice
This control asks a narrower question than a general risk review: could the AI system treat some people worse than others, or exclude people it should serve. A hiring-screening AI or a customer-facing chatbot needs someone to look at who is affected, whether outcomes differ across groups, and whether anyone with a disability or limited language ability is disadvantaged. The AI system impact assessment is where this belongs. Auditors ask for a concrete example: did anyone check whether the AI vendor's model treats non-native speakers or older applicants differently.
Common gaps
The impact assessment asks about data risk but never asks whether the AI treats different groups of people differently.
No one considered accessibility, whether people with disabilities can use or are fairly assessed by the AI system.
Impact review happened for the main use case but not for a secondary group the tool also affects, such as job applicants versus employees.
Questions your auditor will ask
Did you assess whether the AI system affects groups of people differently?
Yes, the impact assessment includes a section on differential and accessibility effects for the AI system's actual affected population.
Who are the affected individuals or groups for this specific AI system?
Named in the assessment record: for example applicants, customers, or employees, depending on what the system is used for.
What did you do when a potential unfair effect was identified?
The finding and the mitigation or decision to proceed anyway, with reasoning, are both recorded in the assessment.
Does this cover accessibility, not only fairness across demographic groups?
Yes, the assessment considers whether people with disabilities can use the system or are assessed by it on equal terms.
Where regulation demands it
GDPR Article 35.7 requires the DPIA to describe the assessed risks to the rights of the individuals concerned, which for AI includes differential impact.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.