AI Risk Assessment Requirements Map: Laws Compared

An organisation running one AI hiring or credit model across several markets can owe five different assessments of it, each with its own trigger, owner, content list and deadline, and they rarely line up. The EU AI Act asks providers for a lifecycle risk management system and some deployers for a fundamental rights impact assessment; the GDPR asks for a data protection impact assessment; California's new CCPA regulations ask for a risk assessment filed with the regulator; New York City asks for an annual bias audit; and US federal agencies must complete an AI impact assessment before using high-impact AI. This map sets out where the law mandates an AI risk or impact assessment, who must do it, what it must contain and when, and where a law that once required one no longer does. It is for AI governance leads, privacy and compliance teams, and the engineers who supply the evidence. Status as of 12 November 2026. For how to run an assessment, see the AI Risk Assessment Guide; this page maps the legal duties.

Source note: this map summarises the official texts and the sources listed at the end, with status as of 12 November 2026. It is not legal advice. Confirm against the official text before relying on it.

Key takeaways

The EU stacks three assessments. Providers of high-risk systems run an Article 9 risk management system, certain deployers complete an Article 27 fundamental rights impact assessment before first use, and anyone processing personal data at high risk still owes a GDPR Article 35 DPIA. Article 27(4) lets the FRIA reuse the DPIA.
EU high-risk dates have moved. As amended by the Digital Omnibus, Article 113 applies the high-risk rules from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, while general-purpose AI model duties, including the Article 55 systemic risk assessment, have applied since 2 August 2025.
California's assessment is filed, not just kept. CCPA regulations effective 1 January 2026 require a risk assessment before using automated decisionmaking technology for a significant decision, with existing processing assessed by 31 December 2027 and first submissions to the Agency due by 1 April 2028.
Some duties are best efforts or have gone. South Korea's AI Basic Act asks high-impact AI operators to "endeavor" to assess fundamental rights impacts, and Colorado's SB 26-189 replaced the 2024 law that required impact assessments with a narrower transparency law effective 1 January 2027.
One evidence base, many outputs. Purpose, affected groups, data, risks, oversight, testing results and mitigations recur in every regime. Build them once per system and generate each legally required format from them.

Regulations and frameworks at a glance

Jurisdiction and instrument	Assessment	Who must do it	When	Filed or kept	Status (12 November 2026)
EU AI Act, Article 9	Risk management system: identify, estimate and evaluate risks, test, adopt measures	Providers of high-risk AI systems	Continuous, across the lifecycle; testing before placing on the market	Part of technical documentation for conformity assessment	Applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I)
EU AI Act, Article 27	Fundamental rights impact assessment (FRIA)	Deployers that are public bodies or private entities providing public services, and deployers of Annex III point 5(b) credit scoring and 5(c) life and health insurance pricing systems	Before first use; update when elements change	Results notified to the market surveillance authority using the AI Office template	Applies with the Annex III high-risk rules from 2 December 2027
EU AI Act, Article 55(1)(a) and (b)	Model evaluation with adversarial testing; assessment and mitigation of systemic risks	Providers of general-purpose AI models with systemic risk	Ongoing	Shown to the AI Office; codes of practice can demonstrate compliance	Applies since 2 August 2025
EU GDPR, Article 35	Data protection impact assessment (DPIA)	Controllers	Before processing likely to result in high risk, including systematic and extensive automated evaluation with legal or similarly significant effects	Kept; prior consultation with the supervisory authority where high residual risk	In force
South Korea, AI Basic Act, Article 35	Impact assessment on fundamental rights	Operators providing products or services using high-impact AI	In advance	Kept; state agencies give priority to assessed products	In force since 22 January 2026; best-efforts duty
United States (California), CCPA regulations, Article 10	Risk assessment	Businesses doing listed significant-risk processing, including ADMT for significant decisions and training ADMT	Before starting; review every three years; update within 45 days of material change	Information submitted to the CPPA annually, first by 1 April 2028	Effective 1 January 2026; existing processing assessed by 31 December 2027
United States (federal agencies), OMB Memorandum M-25-21	AI impact assessment plus pre-deployment testing	Federal agencies using high-impact AI	Before deploying; periodically updated	Documented and reportable to OMB	In effect; documented implementation of minimum practices due within 365 days of issuance
United States (New York City), Local Law 144 of 2021	Bias audit of automated employment decision tools	Employers and employment agencies using the tool	Within one year before use	Summary of results published	Enforced since 5 July 2023
United States (Colorado), SB 26-189	No impact assessment (replaced SB 24-205)	Developers and deployers of ADMT in consequential decisions	Not applicable	Not applicable	Effective 1 January 2027; Attorney General rules at the proposed stage

Scope: which systems trigger an assessment

Each regime draws its line differently, so the same system can be in scope of one and out of scope of another.

By role: the EU AI Act splits the duty between the provider (Article 9) and the deployer (Article 27). California and the GDPR put it on the business or controller that decides on the processing. Local Law 144 puts it on the employer even when a vendor commissions the audit.
By use case: the EU FRIA applies to public-service deployers and to credit scoring and life and health insurance pricing, and excludes Annex III point 2 critical infrastructure systems. California lists significant decisions on financial and lending services, housing, education, employment and healthcare. Korea's high-impact categories are set out in Article 2(4) of its Act.
By data: the GDPR and California duties attach to personal information processing. A model that scores machines or infrastructure without personal data can fall outside both while still being high-risk under the AI Act.
By model scale: Article 55 applies to general-purpose models classified as having systemic risk, regardless of the downstream use case.

AI agents fit these tests by what they do. An agent that screens applicants, adjusts credit limits or triages benefit claims is in scope as the decision system, and the tools and credentials it uses are part of what the assessment has to describe.

What each assessment must contain

EU AI Act Article 9: provider risk management

Steps: identify and analyse known and reasonably foreseeable risks to health, safety or fundamental rights under intended use; estimate and evaluate risks, including reasonably foreseeable misuse; evaluate other risks from post-market monitoring data (Article 72); adopt targeted measures.
Measures order: eliminate or reduce risks by design, then mitigation and controls, then information and training for deployers. Each residual risk and the overall residual risk must be judged acceptable.
Testing: against predefined metrics and probabilistic thresholds, before the system is placed on the market, optionally in real-world conditions under Article 60.
Vulnerable groups: consider whether the system is likely to adversely affect people under 18 and other vulnerable groups.

See the EU AI Act Article 9 Risk Management System Guide.

EU AI Act Article 27: deployer FRIA

Contents (a) to (f): the deployer's processes in which the system is used; period and frequency of use; categories of people and groups likely to be affected; specific risks of harm to them, using the provider's Article 13 information; how human oversight is implemented; measures if risks materialise, including governance and complaint mechanisms.
Reuse: a deployer may rely on earlier assessments of similar cases or on the provider's, and may cross-reference or include parts of an existing DPIA.
Notification: results go to the market surveillance authority on the AI Office template, which may be delivered as an automated questionnaire. Check whether the final template has been published before planning the format.

See the EU AI Act Fundamental Rights Impact Assessment guide.

EU AI Act Article 55: systemic-risk models

Evaluation: standardised, state-of-the-art protocols and tools, including documented adversarial testing.
Systemic risk: assess and mitigate possible systemic risks at Union level, including their sources, from development, placing on the market or use.
Demonstrating compliance: codes of practice under Article 56 can be relied on until a harmonised standard is published. See the EU General-Purpose AI (GPAI) Code of Practice Guide.

GDPR Article 35: DPIA

A DPIA is required where processing, in particular using new technologies, is likely to result in a high risk to individuals, and Article 35(3)(a) names systematic and extensive evaluation based on automated processing, including profiling, that produces legal or similarly significant effects. AI Act Article 26(9) tells deployers of high-risk systems to use the provider's Article 13 information to complete it. See the DPIA Guide.

California CCPA regulations, Article 10

Triggers (section 7150(b)): selling or sharing personal information; processing sensitive personal information; using ADMT for a significant decision; certain automated inferences about consumers in educational or employment contexts; inferences based on presence in a sensitive location; and processing personal information to train ADMT or certain identification or facial recognition technology.
Timing (section 7155): before starting the processing; review at least every three years; update within 45 calendar days of a material change. Processing that began before 1 January 2026 must be assessed by 31 December 2027.
Submission (section 7157): information on assessments conducted in 2026 and 2027 is submitted to the Agency by 1 April 2028, then by 1 April each following year; full reports are produced within 30 calendar days of a request from the Agency or the Attorney General.
Related ADMT rules: businesses already using ADMT for significant decisions must comply with the ADMT article (pre-use notice, opt-out and access) by 1 January 2027.

See the California CCPA Cybersecurity Audit and Risk Assessment Regulations Guide.

US federal agencies: OMB M-25-21

Impact assessment contents: intended purpose and expected benefits with metrics; data quality and fitness for purpose; potential effects on privacy, civil rights and civil liberties with mitigations; reassessment schedule and triggers; costs; independent review by someone who did not build the system; and a signed risk acceptance.
Testing and monitoring: pre-deployment testing reflecting real-world outcomes, then ongoing monitoring for adverse effects on performance, security and legal protections.
Waivers: the agency Chief AI Officer may waive a requirement after a written system-specific risk assessment, recertified annually and reported to OMB within 30 days. Non-compliant uses must be safely discontinued.

Vendors selling AI to US agencies should expect to supply the evidence for these assessments. See the US Federal AI Policy Guide.

South Korea and New York City

Korea, Article 35: operators providing products or services using high-impact AI shall endeavour to assess the impact on fundamental rights in advance; content and methods are set by Presidential Decree. Article 34 separately requires a risk management plan, explanation plan, user protection, human oversight and records for high-impact AI. See the South Korea AI Basic Act Guide.
New York City, Local Law 144: an automated employment decision tool must have had a bias audit within one year before use, a summary of results must be public, and candidates must get notice 10 business days before use. See the NYC Automated Employment Decision Tools (AEDT) Law Guide.

Where the duties overlap

The content lists overlap heavily. Mapping the recurring elements shows what can be built once.

Evidence element	EU Art 9	EU Art 27	GDPR Art 35	OMB M-25-21
Purpose and context of use	Intended purpose	Processes, period and frequency	Description of processing and purposes	Intended purpose and benefits
Affected people	Under-18s and vulnerable groups	Categories of people and groups	Data subjects	Rights and liberties effects
Risk identification	Health, safety, fundamental rights	Specific risks of harm	Risks to rights and freedoms	Privacy, civil rights, civil liberties
Data	Predefined test metrics and thresholds	Provider Article 13 information	Necessity and proportionality	Data quality and fitness
Oversight and mitigation	Design, controls, information	Human oversight; measures if risks materialise	Measures to address risks	Mitigation plans, monitoring
Review cycle	Continuous	On change	When risk changes	Schedule and triggers

California adds its own content list in section 7152 and a three-year review with a 45-day update after material change. ISO/IEC 42005 offers a standard structure that can feed all of these: see the ISO/IEC 42005 AI System Impact Assessment Guide and the AI Impact Assessment Template.

What it means for AI agents and non-human identities

Describe the agent's reach: FRIA point (a) and the OMB purpose element need the processes the system touches. For an agent, that means its tools, data sources and the permissions of the identity it runs as.
Oversight is an access control question: Article 27(e) human oversight and California's human reviewer concept depend on approval gates that the agent's credentials cannot bypass.
Material change includes permission change: new tools or broader scopes can be a material change that restarts California's 45-day clock and the FRIA update duty. Tie permission changes to the assessment register.
Logs are evidence: Article 26(6) requires deployers to keep automatically generated logs for at least six months; per-agent identities make those logs attributable. See the Agentic AI Risk Assessment Template.

Compliance steps

Inventory systems: list every AI system and agent with its owner, markets, use case, personal data and whether you are provider, deployer or both.
Classify per regime: mark each system against the table: high-risk Annex III, FRIA deployer category, GDPR high risk, California significant-risk processing, Korea high-impact, NYC AEDT, federal high-impact.
Build one evidence pack: purpose, affected groups, data lineage, test results, oversight design and mitigations, versioned per system.
Generate the required outputs: DPIA, FRIA, California risk assessment and submission data, bias audit summary, each with its owner and sign-off.
Diarise the clocks: 31 December 2027 and 1 April 2028 in California, 2 December 2027 for EU Annex III, annual NYC audits, three-year California reviews.
Wire in change triggers: model swaps, new data sources and new agent permissions open a reassessment ticket automatically.
Review quarterly: recheck templates, rules and status dates, especially the AI Office FRIA template and Colorado rulemaking.

Measures that show it is working: share of in-scope systems with a current assessment, median days from material change to updated assessment (California allows 45), assessments with independent review recorded, and submissions filed on time.

Common failure patterns

Treating the DPIA as the AI assessment: a DPIA covers personal data risk, not health, safety or non-privacy fundamental rights that Article 9 and Article 27 require.
Planning to stale dates: working to the original EU August 2026 high-risk date or to Colorado's repealed impact assessment duty.
Assessing the model, not the deployment: FRIA and California assessments are about the specific context of use; a provider's generic assessment is input, not a substitute.
No change trigger: assessments written once at launch and never updated after the agent gained new tools or data.
Vendor audit, employer liability: relying on a vendor's NYC bias audit without checking it covers your use of the tool and is less than a year old.

Practitioner checklist

Keep a register of AI systems and agents with the assessments each regime requires.
Record your role (provider, deployer, controller, business) per system and market.
Complete FRIA and DPIA together where both apply, cross-referencing per Article 27(4).
Assess pre-2026 California significant-risk processing before 31 December 2027.
Prepare the first California submission for 1 April 2028.
Renew NYC bias audits before each anniversary and publish the summary.
Link agent permission changes to reassessment triggers.
Retain deployer logs for at least six months under Article 26(6).
Recheck this map against official sources every quarter.

Standards and references

This guide summarises legal requirements for AI risk and impact assessments as of 12 November 2026 and is not legal advice. Related NHI Mgmt Group resources: AI Risk Assessment Guide · Global AI Regulation Map · Colorado AI Act Guide · EU AI Act High-Risk AI Systems Guide

AI Risk Assessment Requirements Map: Which Laws Mandate AI Impact Assessments and When