<!-- AI impact assessment · from Chapter 33 of The Product 360 Handbook -->

# AI impact assessment · [Product] · [Use case] · v[n] · [Date]

**Owner:** [PM]   **Contributors:** [applied AI, security, privacy, legal, UX]   **Linked:** triage, DPIA [link or n/a], FRIA support [link or n/a]

## 1. Purpose and boundaries
- Intended purpose:
- Intended users and settings:
- Prohibited and out-of-scope uses (as they will appear in terms and docs):

## 2. Affected people
| Group | How they are affected | Can they see or contest the output? |
|---|---|---|
| | | |

## 3. Harms
| # | Harm | Principle or NIST GAI risk | Who is harmed | Likelihood | Severity | Current evidence |
|---|---|---|---|---|---|---|
| 1 | | | | | | |

## 4. Mitigations as requirements
| Harm # | Requirement | Acceptance test (eval, gate, log field, UX) | Backlog item | Owner |
|---|---|---|---|---|
| | | | | |

## 5. Human oversight
- Who reviews or approves, at which step, with what information:
- How a user overrides or stops the system:

## 6. Data
- Personal data involved, retention, residency, sub-processors:
- Training on customer data: yes / no; if yes, basis and opt-out:

## 7. Fairness and performance
- Slices evaluated (segment, language, region, other):
- Results and gaps:

## 8. Residual risks
| Risk | Why accepted | Accepted by | Revisit by |
|---|---|---|---|
| | | | |

## 9. Change triggers
Re-assess on: new model or version, new tool permission, new data source, new market, new autonomy level, or a severity 1 or 2 incident.