> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Organisation: Acme Inc

Project: nextjs-saas-example

Overall AI Risk Classification: Limited

Assessment Date: 2026-03-19

Next Review: 2027-03-19

> This document provides a combined impact assessment under the EU AI Act (Regulation (EU) 2024/1689) and the Colorado AI Act (SB 24-205). It evaluates each AI service integrated into this application, classifies risk levels, identifies required mitigation measures, and establishes a monitoring plan.

## 1. Regulatory Overview

### 1.1 EU AI Act (Regulation (EU) 2024/1689)

The EU AI Act establishes a risk-based regulatory framework for AI systems:

Risk Level | Requirements | Timeline
--- | --- | ---
Unacceptable | Prohibited — must not be deployed in the EU | 2 February 2025
High | Conformity assessment, registration, continuous monitoring | 2 August 2026
Limited | Transparency obligations (disclosure to users) | 2 August 2026
Minimal | No mandatory requirements; voluntary codes of conduct | Effective now

### 1.2 Colorado AI Act (SB 24-205)

The Colorado AI Act, effective 1 February 2026, requires developers and deployers of "high-risk AI systems" that make or substantially support consequential decisions to:

- Perform impact assessments before deployment
- Provide transparency notices to consumers
- Implement risk management programmes
- Enable human appeal mechanisms for adverse decisions
- Report discovered algorithmic discrimination to the AG within 90 days

Consequential decisions include those affecting education, employment, financial services, healthcare, housing, insurance, and legal services.

## 2. AI Services Inventory

Service | Data Processed | EU AI Act Risk | Colorado AI Act | Monitoring
--- | --- | --- | --- | ---
openai | user prompts, conversation history, generated content | Limited | N/A | Semi-annual review

## 3. Per-Service Risk Evaluation

### 3.1 openai

Field | Detail
--- | ---
Service | `openai`
Category | ai
Data Processed | user prompts, conversation history, generated content
EU AI Act Classification | Limited
Colorado AI Act | Not in scope
Monitoring Frequency | Semi-annual review

Rationale: This AI service interacts with end users or generates content, triggering transparency obligations under EU AI Act Article 50.

Required Mitigations:

- Disclose AI interaction to users before or during use
- Label AI-generated content where required (deepfakes, synthetic text)
- Maintain AI disclosure documentation
- Provide opt-out mechanism where feasible
- Log user interactions for audit purposes

## 4. Algorithmic Discrimination Assessment

Under the Colorado AI Act, deployers must evaluate AI systems for algorithmic discrimination — differential treatment that disfavours individuals based on protected characteristics.

### 4.1 Protected Characteristics (Colorado)

- Age
- Colour
- Disability
- Ethnicity
- Genetic information
- Gender identity / expression
- National origin
- Race
- Religion
- Sex
- Veteran status

### 4.2 Assessment Checklist

- Identify which AI services make or support consequential decisions
- Test each service for disparate impact across protected characteristics
- Document testing methodology, datasets, and results
- Establish ongoing bias monitoring with alerting thresholds
- Define remediation procedures for discovered discrimination
- Set up 90-day reporting process to Colorado AG for discovered discrimination

## 5. Monitoring Plan

Activity | Frequency | Owner | Next Due
--- | --- | --- | ---
Full impact assessment review | Annual | DPO / AI Governance | 2027-03-19
Bias and fairness testing | Quarterly | Engineering | [Set date]
Performance metrics review | Monthly | Engineering | [Set date]
Incident log review | Monthly | DPO | [Set date]
Regulatory change review | Quarterly | Legal | [Set date]
Consumer complaint analysis | Monthly | Support / Legal | [Set date]
Model drift detection | Continuous | Engineering | Automated

## 6. Transparency Obligations

### EU AI Act (Article 50)

- Users are informed they are interacting with an AI system
- AI-generated content is labelled (deepfakes, synthetic text/audio/video)
- Emotion recognition / biometric categorisation use is disclosed

### Colorado AI Act

- Consumers notified that AI is being used to make or support consequential decisions
- Description of the AI system provided to affected consumers
- Consumer has access to appeal process with human reviewer
- Contact information for questions about AI use is published

## 7. AI Incident Response

Scenario | Action | Timeline | Owner
--- | --- | --- | ---
Discovered algorithmic discrimination | Report to Colorado AG | 90 days | Legal
Serious AI incident (EU) | Report to national authority | Without undue delay | DPO
Model producing harmful outputs | Suspend AI feature, investigate | Immediately | Engineering
Consumer complaint about AI decision | Initiate human review | 30 days | Support
Regulatory inquiry | Engage legal counsel, compile documentation | Within requested timeframe | Legal

## Contact

- Email: legal@acme.com
- Data Protection Officer: dpo@acme-saas.com

This AI Impact Assessment was auto-generated by Codepliant based on code analysis. It covers obligations under the EU AI Act (Regulation (EU) 2024/1689) and the Colorado AI Act (SB 24-205). This document must be reviewed by qualified legal counsel and your AI governance team. It does not constitute legal advice.