AI Risk & Impact Assessment Policy

1 · Purpose

This policy requires that risks and impacts of AI systems – including impacts on individuals, communities, society and the environment – are assessed and managed before and during their use.

2 · Scope

Applies to AI systems Nxt7a develops or materially integrates, and to significant new uses or changes of AI. It covers both technical risk and broader impact on affected stakeholders, including Indigenous communities.

3 · Policy Statements

Assess before deploy. A proportionate AI risk and impact assessment is completed before a new or materially changed AI system is deployed, and reviewed periodically thereafter.

What The Assessment Covers.

• Purpose and context – what the system does, for whom, and the consequences of its outputs.
• Affected stakeholders – who is affected, including vulnerable groups and Indigenous communities, and how.
• Risks – accuracy, bias and fairness, privacy, security, safety, environmental misrepresentation, and misuse.
• Data – provenance, quality, rights and sensitivity of training and input data (links to Model & Data Governance).
• Impact severity and likelihood – assessed to prioritise mitigation.
• Mitigations and oversight – controls, human oversight, and residual-risk acceptance.

Environmental claim sensitivity. Because Nxt7a's outputs inform environmental and biodiversity decisions and claims, assessments give particular weight to accuracy and the risk of misleading conclusions.

Indigenous impact. Where AI touches Indigenous data, knowledge or interests, impact is assessed with the requirements of the Data Sharing & Indigenous Data Sovereignty Policy, including consent and benefit-sharing considerations.

Proportionality. Depth of assessment scales with the system's risk; low-risk internal uses get a lightweight review, higher-impact systems get full assessment and sign-off.

Records and sign-off. Assessments are documented, with risk acceptance recorded by an accountable owner. Higher-risk systems require CEO or AI Governance Lead sign-off.

4 · Roles & Responsibilities

• System owners complete and maintain assessments.
• AI Governance Lead reviews assessments and methodology.
• CEO signs off high-risk systems and accepts residual risk where significant.

5 · Compliance, Monitoring & Breach

Deploying an in-scope AI system without an assessment is a policy breach. Assessments are reviewed in audits and after incidents.

6 · Related Documents

Responsible AI Policy · Model & Data Governance Policy · AI Use Guidelines · Privacy Policy · Data Sharing & Indigenous Data Sovereignty Policy.

7 · Standards Mapping

• B Corp: Customers.
• ISO/IEC 42001:2023: A.5 (AI system impact assessment); supports Clause 6 (risk and opportunity planning).

8 · Version History