What an algorithmic impact assessment makes a team write down

Someone wants the assistant to choose who jumps the queue. Risk asks what a wrong call does to the person waiting. The room has a vendor slide and no answer.

Canada's Algorithmic Impact Assessment is a public questionnaire the Canadian government uses before it lets a system make or support an administrative decision, and for those decisions it's mandatory. It was developed in the open and published for sharing and reuse under an open licence. A private team can use the questions without becoming a Canadian department. The useful part is what the questions force into writing before a system is allowed to act.

What the questionnaire makes you write down

An algorithmic impact assessment, in this tool, is a scored set of questions that produces an impact level. The current version has 65 risk questions and 41 mitigation questions. The risk questions cover the project, the system, the algorithm, the decision, the impact and the data. Impact here includes rights and freedoms, equality, dignity, privacy and autonomy, health and well-being, economic interests, the sustainability of an ecosystem and how long a decision lasts and whether anyone can reverse it. The mitigation questions ask who was consulted, whether the data is good enough, whether a person can see why a decision was made and challenge it, and whether privacy was designed in.

Scores sort a project into four impact levels, from Level I (little to no impact) to Level IV (very high impact). Canada's rules then ask for stronger measures as the level rises, including more human involvement in the decision. Completing the mitigations doesn't lower the level. Only a new assessment, with updated facts about the system, can change it.

When the assessment happens

The instructions say to complete it at the start of design, then again before the system goes into production, so the published result matches the system that was actually built. Review it on a schedule, and again when the function or the scope changes. A multidisciplinary team is the intended room, because the questions cross the service, the data, the legal authority and the people on the receiving end. If an answer is unknown, the tool says to select the lowest score option. An unknown stays on the record as open risk. It doesn't drop out of the score.

What a company can take from it

1. Name the decision the system will inform, contribute to or make, and say whether it assists a person's judgment or replaces it.
2. Name who is subject to that decision, what harm is plausible, how long the effect lasts and how a person reverses it.
3. Name the data, including any personal information, and the quality checks the team will actually run.
4. Do this at the start of design and again before go-live, with the people who will own the harm in the room.

A line in a policy that says to use AI responsibly answers none of those. The Canadian questionnaire answers them in public, and a company can reuse the questions under the open licence without adopting Canada's whole rulebook. A day spent putting a named owner beside each use is what an AI governance workshop is for. The assessment still has to be completed by the people who know the decision.