Rules
What the AIIA of the Dutch Ministry of Infrastructure is, who must use it, how it is structured and how it relates to the IAMA and the DPIA.
An AI Impact Assessment (AIIA) is a questionnaire a team uses to weigh up beforehand whether an AI system is needed, what it means for people and how to build and use it responsibly. The AIIA was created by the Dutch Ministry of Infrastructure and Water Management (IenW). It can be downloaded free of charge and is not required by law.
On the Dutch government's publication page, the ministry calls the AIIA a tool for making trade-offs when deploying artificial intelligence. The aim is to improve accountability, quality and reproducibility. This article explains how the AIIA is structured, who it is meant for and how it relates to the other assessments you will come across. It is an explanation, not legal advice. Position as at 5 November 2026.
The AIIA was developed within IenW, by the ministry's CIO office together with the data lab of Rijkswaterstaat and the IDlab of the Human Environment and Transport Inspectorate. The ministry's executive board adopted the first version on 4 July 2022; this is stated in the English edition of version 2.0.
Version 2.0 (PDF, Dutch) appeared in December 2024. That version takes the final text of the AI regulation into account and aligns more closely with the IAMA, the human rights instrument Utrecht University developed for the government.
Within IenW, yes. According to version 2.0, the AIIA must be completed when a system goes into production, and a pilot counts too. The obligation applies to every AI system, regardless of its risk level under the AI regulation. For simple algorithms based on fixed rules, the AIIA is not mandatory.
Outside that ministry, the AIIA is not an obligation. No legislation prescribes it, neither for the government nor for businesses. The Algorithm Framework, the overview of requirements and tools the Dutch government maintains for algorithms, describes it as a mandatory instrument within IenW that is now also used more widely. Anyone who uses the AIIA therefore chooses to do so.
The AIIA consists of two parts and three annexes. Part A deals with whether you should want the system at all. Part B deals with how to build and use it properly.
The three annexes cover the risk level under the AI regulation, the questions for those who supply or use a high-risk system, and generative AI.
Not every question is mandatory. The blue questions must always be answered, the green ones only where relevant. With only the blue questions, you have a faster variant: the quick scan. The AIIA explicitly calls for a team: one person does not complete it alone. Think of the commissioning party, someone who understands the technology, someone who knows the work and a lawyer or privacy officer. The Algorithm Framework page has completion templates in Dutch and English.
Anyone starting out with AI comes across four abbreviations. They overlap, but they are not the same.
The IAMA, the Impact Assessment Mensenrechten en Algoritmes (human rights and algorithms impact assessment), concerns the implications for human rights. The updated IAMA of February 2026 has been aligned with Article 27 of the AI regulation. The Algorithm Framework puts the difference like this: the AIIA was developed specifically for AI, while the IAMA can be applied to all kinds of algorithms.
Version 2.0 of the AIIA incorporates the IAMA's questions on fundamental rights. According to a footnote in that version, you therefore no longer need to complete both, unless you need extra help with the fundamental rights trade-off. More about the IAMA is in our article on the Algorithm Register and the IAMA.
The DPIA comes from Article 35 GDPR and is a statutory obligation. The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, writes that you must carry out a DPIA when processing is likely to result in a high privacy risk. The AIIA does not replace that obligation. The chapter on data governance says that when personal data is processed, you first complete a pre-scan to determine whether a full DPIA is needed. How to approach a DPIA for an AI application is covered in our article on the DPIA for AI tools.
The fundamental rights impact assessment, or FRIA, comes from Article 27 of the AI regulation. It is mandatory for public bodies and organisations providing a public service that intend to use an Annex III high-risk system, and for those using AI to assess creditworthiness or to set premiums for life and health insurance. Following the 2026 amendment to the AI regulation, that obligation applies from 2 December 2027.
The AIIA does not name the FRIA. It does ask about the risk level, and for a high-risk system you complete annexes 1 and 2. Those annexes cover the obligations of those who supply or use such a system. A completed AIIA is therefore good preparation, but not a FRIA. What belongs in a FRIA is worked out in our article on the fundamental rights impact assessment.
| Instrument | From | What it covers | Mandatory |
|---|---|---|---|
| AIIA | Ministry of Infrastructure and Water Management | Weighing up and responsibly building and using an AI system | Within IenW for every AI system; not outside it |
| IAMA | Ministry of the Interior and Kingdom Relations (BZK), developed by Utrecht University | The implications of an algorithm for human rights | No statutory obligation |
| DPIA | GDPR, Article 35 | The risks of processing personal data | Yes, where a high risk is likely |
| FRIA | AI regulation, Article 27 | The implications of a high-risk system for fundamental rights | Yes, for certain users, from 2 December 2027 |
Position as at 5 November 2026. The column on obligations is a summary; the legal text and your own organisation's policy take precedence.
Yes, as a tool. The AIIA can be downloaded free of charge, and the Algorithm Framework notes that it is also used outside IenW. It was, however, written for a ministry: some passages assume this, such as the reference to review by the Auditdienst Rijk, the central government audit service. You skip those or translate them to your own situation.
For a firm that wants to work with an AI assistant, the AIIA is above all a way of ordering the right questions. Why do you want it? What data goes into it? Who checks the outcome? What do you do when things go wrong? These are the same questions you answer in an AI policy; an outline is in our article on writing an AI policy.
A completed questionnaire does not make a system safe. It shows that you have made the trade-off. It does not change what an employee pastes into a chat window. A file with names, BSNs (Dutch citizen service numbers) or health data does not belong in a chatbot on a personal account. What happens when you upload a document is covered on our page about AI chatbots and the GDPR.
PrivaSearch makes documents searchable after personal data has been replaced with pseudonyms and a colleague has checked this. It searches and quotes; it does not assess people and it does not make decisions. The page about the GDPR and the AI Act says this supports a classification outside the high-risk categories, depending on intended use and working practices. Whether and how you complete an AIIA is your own decision.
For your records, your workspace provides three starting documents based on your own set-up: an AI policy, a DPIA starting document and the entry for your record of processing activities. They are starting documents, not legal advice. PrivaSearch does not complete an AIIA for you. The documents do give you the facts you need for the chapters on data governance and risk management: which data, which measures, which retention period.
Three elements built into everyday use fit the questions in Part B. Human review is mandatory. Answers refer to a document and page. And actions are logged. Pseudonymised data remains personal data for your organisation. Read how the steps follow each other on How PrivaSearch works. To see it in action, request a demo.
AIIA stands for AI Impact Assessment. It is a questionnaire from the Dutch Ministry of Infrastructure and Water Management that a team uses to weigh up beforehand whether an AI system is needed, what it means for people and how it is built and used responsibly. The current version is 2.0, from December 2024. The AIIA can be downloaded free of charge from the Dutch government's website.
Only within the Ministry of Infrastructure and Water Management, for every AI system that goes into production, including a pilot. For other public bodies and for businesses, the AIIA is not a statutory obligation. The government's Algorithm Framework notes that it is now also used more widely. Anyone who completes it chooses to do so.
The AIIA was made specifically for AI and covers the whole process, from the trade-off to managing risks. The IAMA covers the implications of algorithms for human rights and can also be used for algorithms that are not AI. Version 2.0 of the AIIA incorporates the IAMA's questions on fundamental rights, so you usually do not need to complete both.
No. A DPIA is an obligation under the GDPR when processing personal data is likely to result in a high risk. The AIIA refers to this itself: where personal data is involved, you first complete a pre-scan to determine whether a full DPIA is needed. You can use answers from the AIIA in the DPIA, but the DPIA remains a separate document.
No. The FRIA, the fundamental rights impact assessment, is an obligation under Article 27 of the AI regulation for certain users of high-risk systems, from 2 December 2027. Outside the ministry that created it, the AIIA is a voluntary tool. It does ask about the risk level and the obligations that come with high risk, which makes it good preparation.
The AIIA itself does not say, and it depends on the system. Anyone who answers only the blue questions of the quick scan finishes sooner than someone who works through all chapters and annexes. Expect several sessions with a team, because the AIIA calls for knowledge of the purpose, the technology, the data and the rules.
When entering personal data into an AI chatbot is a data breach, when you must report it and what to do during the first 72 hours after discovery.
Member states want AI processing to rest on legitimate interests and pseudonymisation to be regulated differently. What the text says and what to do now.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →