An AI impact assessment you work out with the agents: every harm tested on real outcomes, every score cited, every decision signed before go-live
Every high-risk AI use assessed before go-live, each harm tested, cited and signed.
See one case, screen by screen ↓AI Impact Assessment drafts fundamental-rights and algorithmic impact assessments for deployers of AI. Eight agents describe the use case from your documents, map the people affected and the rights at stake on a rights canvas, test the system's real outcomes by group, write the objections an affected person would raise, and plan every fix with an owner and a re-test. The AI governance lead works with them in one conversation, checks the cited passages and approves; legal counsel signs before the authority is notified.
How to choose AI solutions for back-office and enterprise work →
Updated
A company that uses someone else's AI to decide who gets a home, a loan, a job or a service is a deployer. From 2 December 2027, the EU AI Act (Art. 27) makes deployers that are public bodies or provide a public service, and deployers that score creditworthiness or price life and health insurance, write a fundamental rights impact assessment before first use — the process, the period and frequency of use, who is affected, the specific risks of harm, human oversight and what happens if a risk materialises — and notify the market surveillance authority. ISO/IEC 42001 and 42005 ask for AI system impact assessments, and US states ask for algorithmic impact assessments.
Today it is a Word template filled from interviews. The use case is copied from the vendor's marketing, not the instructions for use. Groups are listed as “users”, so children, guarantors and staff are left out. Scores are “medium” by consensus in a workshop, with no evidence behind them. Nobody tests whether the system treats groups differently on real outcomes, because the deployer does not hold protected-characteristic data. Mitigations have no owners or dates, sign-off happens with actions open, and the assessment goes stale the day the vendor retrains the model.
Estimated split for one fundamental rights impact assessment of a bought-in AI system, by hand and with the solution.
Eight agents describe, map rights, test outcomes, argue for the affected and plan fixes; the AI governance lead approves.
Kestrel & Vane Living, the housing arm of Kestrel & Vane Group, plans to switch on TenantFit v3.2 from Lodgewell Analytics in 11 Dutch cities on 1 December 2026. It scores rental applicants: recommend approve, refer or recommend decline. Amara Lindqvist, AI Governance Lead, has 48 days to assess it. Here is how she works with the agents, screen by screen, in the working solution.
Her home shows 14 AI uses in the register, 8 assessments open, 4 decisions that need her and 2 systems going live in the next 60 days. Beside it the agents report in plain sentences: the change watcher re-opened the candidate shortlist assessment because Talvero moved its ranking to a third-party language model, and the test agent says TenantFit's pilot extract is in — 4,812 recommendations from Marenburg.
“Agents propose, explain and cite. Every decision here is yours.”
The context agent wrote the Art. 27(1)(a)(b) description in 14 sentences from Lodgewell's instructions for use and data dictionary, the lettings process map, the pilot plan, the services agreement and the nomination agreement — each sentence with the number of the passage it rests on. It did not guess what it could not find: it asked Jonas Feld two questions. He answered the first (scores are kept 12 months) and attested the description on 12 Oct; the second is still open on screen.
The context agent's limit: unknowns become questions, never guesses.
TenantFit sits at the centre: 9,600 applications a year, 11 cities, 23 inputs read. Around it, the impact agent placed six affected groups — applicants, applicants from Oosterkade, Sluiswijk and Brakelpoort, applicants on benefit or disability income, children in applicant households, guarantors and 46 lettings advisers — with each right at stake, its Charter article and a severity × likelihood score that opens its source. Non-discrimination for the three areas is marked “To test”.
“Next: test the pilot's 4,812 recommendations by group. Your framework requires a disparity check before sign-off.”
Amara clicks “Run the check”. The test agent comes back in the conversation: applicants whose current address is in the three areas were recommended for approval 54.6% of the time (612 applicants), against 72.6% for all others (4,200) — 18.0 points less often, an impact ratio of 0.75 under the 0.80 alert. It raises non-discrimination to High (4 × 4 = 16), and the mitigation planner proposes M1: drop the postcode area and its two derived inputs.
“Confidence: high on the gap · medium on the cause.”
The plan ran in six steps on the de-identified extract — names, dates of birth, ethnicity and contact details are not held. Groups are built with a district proxy: the three areas are where 47–52% of residents come from one community. The gap is significant (p < 0.001). Before anyone builds anything, the simulation drops postcode area, distance moved and the area arrears index: the gap narrows to 4.1 points, ratio 0.94, with agreement with advisers at 85.7%.
“A geography proxy: it shows the effect on those areas, never any person's ethnicity.”
Amara accepts the finding and types the instruction into the conversation. Jonas, the product owner, replies there: Lodgewell can switch the three inputs off by 11 Nov, so the re-test on 18 Nov runs on the real configuration. The mitigations list now shows eight measures, each with an owner and a date, and go-live on 1 December is gated until M1 and M4 are done, M2 is in place and the re-test shows an impact ratio of 0.90 or more.
The mitigation planner counts a measure only when its owner accepts.
The devil's advocate wrote five objections in the voice of an affected person, each answered by a mitigation or left open. One was not answered: a lettings adviser says “If my screen says ‘decline 0.91’ and the handbook tells me to follow it, I will follow it. Your human review will be a rubber stamp.” Amara escalates it. Dr. Henrik Osei-Brandt of the AI Ethics Board decides blind-first review: advisers record their own view before the score is shown, and agreement rates are never used in performance reviews.
The devil's advocate cannot change a score; it hands the question to a person.
The signatures run in order: Jonas attested the description, Sofia Brennan cross-referred DPIA-2026-031 to three rights, and the ethics board gave its opinion. Amara chooses A2 · Approve with conditions — C1: M1 and M4 done, M2 in place and the 18 Nov re-test at 0.90 or more; C2: a monthly disparity check by area from 1 Dec, pausing under 0.80; C3: blind-first review — and signs with the e-signature tied to her sign-in.
“A2 · Approve with conditions — deploy only when the conditions below are met. Go-live is gated.”
Priya signs L2 · Complete; conditions recorded. Only then does the filing agent's notification to the market surveillance authority become sendable: sections A to F filled from the signed assessment only — process, period and frequency, affected categories, risks of harm including the measured 18.0-point gap, human oversight, and measures if risks materialise. It is submitted on Priya's signature, receipt MSA-2026-004417.
The filing agent never submits before legal sign-off.
The change watcher checks every AI use daily for new versions, inputs, countries and drifting outcomes. Lodgewell has announced TenantFit v3.3 for Q1 2027, so the assessment will re-open when it is delivered. The 18 Nov re-test after M1 and M4 is scheduled and gates go-live on 1 Dec. When the vendor portal timed out at 06:00, the screen said so and offered a retry.
The change watcher re-opens an assessment; it never closes one.
The same assessment, seen by the five people who carry it — what the work looked like, and what it looks like now.
Eight agents describe, map rights, test outcomes, argue for the affected and plan fixes; the AI governance lead approves.
Writes the use-case description (Art. 27(1)(a)(b)) from the process documents, the provider's instructions for use and the contracts, sentence by sentence, for the product owner to attest.
Identifies the groups an AI use affects and the rights at stake, and scores each one severity × likelihood with its reasons and sources on the rights canvas.
Plans and runs a disparity check on the system's de-identified outcomes by group, states its method and limits, and simulates a fix on the same rows before anyone builds it.
Writes the strongest objection an affected person would raise, in their voice, challenges each response and escalates the ones that are not answered.
Turns each risk into a measure with an owner, a date and a re-test, tracks it to done and holds go-live until the conditions are met.
Drafts invitations to stakeholders and codes their responses into themes with quotes, each linked to a right on the canvas.
Fills the authority questionnaire from the signed assessment, prepares the notification and writes the board report.
Checks every AI use daily for new model versions, features, inputs, countries and drifting outcomes, and re-opens the assessment when an element changes (Art. 27(2)).
Approves and signs. The agents propose; a named person decides.
Ask in plain words, on the canvas or from anywhere in the solution. Every answer points to its source, and the agents can act on what you say.
Why is non-discrimination high for TenantFit?
Because the pilot measured it. Applicants whose current address is in Oosterkade, Sluiswijk or Brakelpoort were recommended for approval 54.6% of the time against 72.6% for everyone else — an impact ratio of 0.75, under the 0.80 alert. The likely cause is the postcode input. I have marked it on the canvas.
Which AI uses go live in the next 60 days?
Two: TenantFit tenant screening on 1 Dec 2026 (48 days, in review) and the Interview summary assistant on 5 Dec 2026 (52 days, testing). Both need a signed assessment before first use. I filtered the register for you.
What does Article 27 require before first use?
Six things, written down before first use: the process, the period and frequency of use, who is affected, the specific risks of harm, human oversight, and what you do if risks materialise — then notify the market surveillance authority with the AI Office template. I have opened the passage.
Draft the board summary for TenantFit
Draft: “TenantFit, a tenant-screening system, goes live on 1 December. Its pilot recommended approval 18 points less often for applicants from three areas home to one minority community. The postcode inputs are being removed and it will not go live until a re-test passes on 18 November.” I put it in the board paper.
13 screens from the working solution, on its sample data. Pick one to see it large.
The scale, the thresholds and the rules for which assessment applies when are settings. Every change is versioned and logged.
| Setting | Default | Choose from |
|---|---|---|
| Scoring scale | Severity × likelihood; High from 9, Medium from 4 | Your own bands, saved as a new version |
| Impact ratio alert | Under 0.80 — a finding is raised | Your own ratio; can be changed for one assessment, with the change recorded |
| Impact ratio watch | Under 0.95 — the group is watched | Your own band |
| Minimum group size and significance | 100 people · p-value 0.05 | Smaller groups are reported but not scored |
| FRIA before first use | On — public body, public service, or Annex III 5(b)/(c) | On · Off |
| Algorithmic impact assessment and ISO/IEC 42005 method | On — any consequential decision; every assessment, including non-EU uses | On · Off, each |
| Colorado AI Act | Off for now, watched — its dates changed in 2025 and 2026; re-assess within 90 days of a change | On · Off |
| SLAs | Owner accepts a mitigation in 3 working days · ethics opinion in 5 · re-assessment within 30 days of a change | Your own days, with in-app, daily email and overdue reminders |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate: the working-day split, and the 4–8 weeks for a first assessment, which we estimate from the workload described in practitioner FRIA guides (not a measured or published figure) · “typical” = published law (Regulation (EU) 2024/1689, Art. 27(1)(a)–(f) — the six elements of a fundamental rights impact assessment, and Art. 27(3) on notifying the market surveillance authority). Annex III duties apply from 2 December 2027 under Regulation (EU) 2026/1744 and are named as context; ISO/IEC 42001 clause 6.1.4 and ISO/IEC 42005:2025 describe AI system impact assessments; the 0.80 alert follows the four-fifths rule (29 CFR 1607.4(D)). People, companies, cities, districts, vendors and systems named on this page are fictional — characters and sample data in the working solution.
AI Impact Assessment drafts fundamental-rights and algorithmic impact assessments for deployers of AI. Eight agents describe the use case from your documents, map the people affected and the rights at stake on a rights canvas, test the system's real outcomes by group, write the objections an affected person would raise, and plan every fix with an owner and a re-test. The AI governance lead works with them in one conversation, checks the cited passages and approves; legal counsel signs before the authority is notified.
Under Article 27 of the EU AI Act, from 2 December 2027, deployers of high-risk AI that are public bodies, private entities providing public services, or that use AI for creditworthiness or life and health insurance pricing must assess the impact on people's fundamental rights before first use. It covers the process, the period and frequency of use, the people affected, the specific risks of harm, human oversight and the measures if a risk materialises, and the deployer notifies the market surveillance authority of the result.
The test agent runs a disparity check on the system's de-identified outcomes, read-only, and builds groups from a stated proxy — in the demo, the districts where official statistics show most residents come from one community. It reports the gap in points, the impact ratio against your alert and the significance, says what the proxy can and cannot show, and never infers any person's ethnicity.
Yes. The test agent simulates the fix on the same rows. In the demo, dropping the postcode area and its two derived inputs narrows an 18.0-point gap to 4.1 points, an impact ratio of 0.94, and the real re-test is scheduled before go-live.
Yes. The data protection officer links the existing GDPR Article 35 DPIA to the rights it already covers and signs the cross-reference. Article 27(4) lets the fundamental rights impact assessment complement an existing DPIA, so nothing is written twice.
The change watcher checks every AI use daily for new versions, features, inputs, countries and outcome drift. When an element changes it re-opens the assessment, proposes the new scope for a person to approve and starts the clock — 30 days by default, 90 under Colorado's rule.
Yes. The agents propose, explain and cite. A person confirms every score, the owner accepts every mitigation, the ethics board decides escalated objections, and the AI governance lead and legal counsel sign with reason codes. Nothing is sent outside without a person, and every action is on an audit trail that cannot be edited.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your AI register, your impact framework and thresholds, and the instructions for use of the systems you deploy — and it goes live once every quality gate has passed. We will walk you through it on one of your own AI uses first.
Every request answered inside its legal clock, with no other person's data released.
1-min demoEU AI Act ComplianceEvery high-risk AI system documented, cited and signed before 2 December 2027.
1-min demoPrivacy Impact AssessmentEvery new project assessed before launch, with each answer traced to its source.
1-min demoWe'll run AI Impact Assessment on one of your own AI uses, with its instructions for use and a sample of its outcomes.