Assessing the effect of a system on the people subject to it, rather than the risk it poses to your organisation. Who could be disadvantaged, how would they know, and what can they do about it. It complements a privacy assessment, which asks a narrower question.
Technical view
Typically covers purpose and necessity, affected populations including groups likely to be disproportionately affected, disaggregated performance evidence, human oversight arrangements, redress routes, and monitoring commitments. Public sector versions are mandatory in several jurisdictions, sometimes with a published register. The distinguishing feature from internal risk assessment is that harms to third parties are the subject, which changes what evidence is required.
Related
Part of AI Terminology Index, section: Governance, Law and Regulation.