{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"AI Governance","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-04","description":"Operate a documented AI impact assessment process performed before deployment and repeated on significant change, assessing consequences for individuals, groups of individuals, and society, including fairness, safety, and fundamental-rights effects. Classify each system against applicable regulatory risk categories, including any high-risk designation, and record the classification rationale. Retain assessment reports, approvals, and reassessment triggers as evidence.","details":{"control_category":"administrative","control_type":"preventive","domain":"AI Governance","guidance":[],"members":[{"control_id":"A.5.2","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"A.5.3","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"A.5.4","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"A.5.5","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"AIA-Art6-7","coverage":"full","framework":"eu-ai-act","relationship":"superset_of"},{"control_id":"C001","coverage":"partial","delta":"a system-specific AI risk taxonomy with severity tiers that drives output filtering, monitoring categories, and third-party test scope","framework":"aiuc-1","relationship":"intersects_with"},{"control_id":"AIA-Art27","coverage":"full","framework":"eu-ai-act","relationship":"superset_of"}],"statement":"Operate a documented AI impact assessment process performed before deployment and repeated on significant change, assessing consequences for individuals, groups of individuals, and society, including fairness, safety, and fundamental-rights effects. Classify each system against applicable regulatory risk categories, including any high-risk designation, and record the classification rationale. Retain assessment reports, approvals, and reassessment triggers as evidence.","title":"Assess impacts and classify AI systems before deployment","unified_id":"UC-AI-04"},"id":"uc:UC-AI-04","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-04","sourceIds":["aiuc-1","eu-ai-act","iso-42001"],"sourceUrl":null,"title":"UC-AI-04 — Assess impacts and classify AI systems before deployment","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:061a1d5744eb1bccd4d622a3afec6174c9dc3c435f2600f98573247bfd84896d","properties":{"rationale":"Pre-deployment impact assessment plus high-risk classification is the mandated control education-AI is faulted for lacking, gating unfair scoring/exclusion.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/risk-ai-highrisk-education-fe20b899.json","targetId":"risk:ai-highrisk-education","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:20b5b29cb2a9724d9380d6511c61acf9b3573c564e397935fff41647d5731bfa","properties":{"rationale":"Fundamental-rights impact assessment and high-risk classification is the safeguard law-enforcement AI is faulted for lacking before deployment.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/risk-ai-highrisk-law-enforcement-7d4537e1.json","targetId":"risk:ai-highrisk-law-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:290c7197b3c6537d87d8c837c2c5745aced7a027b965811dd1a24b0f5631eeb4","properties":{"rationale":"Impact/DPIA assessment and classification gates biased or opaque employment-AI before deployment, the assessment the risk says is missing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/risk-ai-highrisk-employment-f50a88ef.json","targetId":"risk:ai-highrisk-employment","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:543fc075aeb410d167a9444e9c994bcfb4a6371a0eba4e32524110a5d7b7bfe3","properties":{},"sourceDetailPath":"/data/v1/records/wf-d59-b3ddf606.json","sourceId":"wf:D59","targetDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","targetId":"uc:UC-AI-04","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:55b035fee8511332600e8a626354b3dd8f64e7151f94951b8501c6321f34ece6","properties":{"rationale":"Pre-deployment safety-impact assessment and risk classification is the risk-management step critical-infrastructure AI is faulted for operating without.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/risk-ai-highrisk-critical-infra-a7a37365.json","targetId":"risk:ai-highrisk-critical-infra","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:59a7b4b519afe2cfaafdcd28ac7ed46038f6fee7908bc773ee348271f978946c","properties":{"control_id":"A.5.2","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-5-2-421bdcd4.json","targetId":"ctrl:iso-42001:A.5.2","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:72be0e6e45efd491fdce3d0bd12f80a632ca7dbb65964c613c5d6b3d89df9a9b","properties":{"rationale":"Pre-deployment impact assessment and rights-safeguard classification gate the wrongful migration/border decisions the risk says lack them.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/risk-ai-highrisk-migration-border-47d2b2d8.json","targetId":"risk:ai-highrisk-migration-border","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:844ae35757fda107f5758acfae8ee0c79cb13e92306be7f2eef8590ecf5f50d0","properties":{"rationale":"Impact assessment of effects on individuals/groups/society and fundamental rights is the core high-risk control gating justice/democracy harms before deployment.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/risk-ai-highrisk-justice-democracy-7f7e4bfd.json","targetId":"risk:ai-highrisk-justice-democracy","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8a69cec2042cee3702ebb5634a5de10a7104e70a3e3072d0fe3076b02acd0e83","properties":{"control_id":"A.5.4","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-5-4-4ae08368.json","targetId":"ctrl:iso-42001:A.5.4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:902c276b4dc87e533c261581715a8a3fe51a400ee8a18101b7bdca31eed125b9","properties":{},"sourceDetailPath":"/data/v1/records/wf-r13-431c488e.json","sourceId":"wf:R13","targetDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","targetId":"uc:UC-AI-04","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a4b0b9a8be89cc1c9692ba1f936a0c98fb8a398638a3faaec9ca59b260ba19b6","properties":{"rationale":"Fundamental-rights impact assessment and classification is the exact control biometric-ID systems are faulted for lacking, blocking unassessed deployment.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/risk-ai-highrisk-biometrics-c23b524a.json","targetId":"risk:ai-highrisk-biometrics","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bd2bb0339a2dce076f5f2fb913754144f1341e6f5e2837680fbb154fb1b30166","properties":{"control_id":"A.5.3","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-5-3-5192e9d2.json","targetId":"ctrl:iso-42001:A.5.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d23c16c0475ddff17cb84767adaa69eb11e7677c2c55a2aa5d8ac340b162dc89","properties":{"control_id":"C001","coverage":"partial","delta":"a system-specific AI risk taxonomy with severity tiers that drives output filtering, monitoring categories, and third-party test scope","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c001-6bc6c173.json","targetId":"ctrl:aiuc-1:C001","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e7bf675e8de47e1ad36f5b453af2b1185cad01ea646ba2fe35f866fcf6405dcd","properties":{},"sourceDetailPath":"/data/v1/records/wf-g1-14bc355c.json","sourceId":"wf:G1","targetDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","targetId":"uc:UC-AI-04","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ecda917b2415cdd8e1478bce0ad7b5ecbdafc1ebb254f2f79dbe0ac11052787a","properties":{"control_id":"A.5.5","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-5-5-35172fd6.json","targetId":"ctrl:iso-42001:A.5.5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:edc524182fec3365afded04e66505533a46f61f318adf773398145e3a01d5efc","properties":{"control_id":"AIA-Art27","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art27-7b550500.json","targetId":"ctrl:eu-ai-act:AIA-Art27","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f08b3091da2f2ebef68bbc42112348fdd319a558f738645d33dbdb66a0e005e4","properties":{"control_id":"AIA-Art6-7","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art6-7-cd7435c0.json","targetId":"ctrl:eu-ai-act:AIA-Art6-7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ff8d2ddaf6053e714102bc6901796960487a9a0406bc17c7f8c41f929e61f829","properties":{"rationale":"Impact assessment plus conformity classification gates unfair benefit/credit/insurance decisions the risk says deploy without required controls.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-04-b35afd39.json","sourceId":"uc:UC-AI-04","targetDetailPath":"/data/v1/records/risk-ai-highrisk-essential-services-46de2ea9.json","targetId":"risk:ai-highrisk-essential-services","type":"mitigates"}],"schemaVersion":1}