The AI Application Impact Assessment (template in Appendix C) is conducted at stages of the lifecycle to identify processes and principles aligned with the Practice Guide, benefits, negative impacts on stakeholders, and required controls and monitoring. It has four components: risk gating criteria that distinguish high-risk applications requiring IT Board or CIO review and approval, assessment questions across the lifecycle answered qualitatively, references to Practice Guide sub-sections, and impact considerations on beneficial and negative effects. The Project Team starts it at planning by answering the risk gating questions and the purpose and accountability section; a 'yes' to any gating question makes the project high-risk and requires IT Board or CIO endorsement before it starts, otherwise PAT/PSC endorsement suffices; the remaining questions are completed as the project progresses regardless of gating, every question is answered, and where practices are not followed and negative impacts detected a mitigation plan or justification is documented for the PSC/PAT's go or no-go decision at each stage. The assessment is a live document, the Project Team reviews the full assessment and the impact section collaboratively and checks whether further gates were triggered, and the PSC/PAT reviews and approves results against business case, impacts and plans.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.