Your AI impact assessment isn't a vibe check

Thesis

Clause 6.1.4 is a body-clause requirement; you can’t exclude it through the Statement of Applicability. A thin assessment can pass one audit, but it has to stay consistent with the rest of the management system, across cycles, under questioning. That is where theatre fails.

Reader

Government buyers who want confidence an assessment isn’t theatre, and NfPs whose systems affect vulnerable people.

Opening failure

A tidy annual meeting concludes “negligible impact, likelihood low”, while the risk register rates a related risk as high.

Beats

1. Auditors certify conformity, not the quality of judgements. The standard doesn’t say how rigorous a process must be.
2. What still catches a thin process: evidence that exists and is controlled (7.5.3); consistency across the risk register (6.1.2), management review and the assessment; the competence of the assessors (7.2).
3. Trend over cycles. The same conclusion repeated while the system’s reach visibly grows is what surveillance audits find.
4. A thin process is easy to build for one audit and hard to sustain against everything else in the system.

Market angle

For NfPs, the people affected often have the least ability to push back. The assessment is where you hear them.

What you can do on Monday

Put your impact assessment next to your risk register and check that the same risks carry the same ratings.