AI Impact Assessment on a Hiring System

Introduction

30 Second Summary

Every time you apply for a job online, there is a chance an AI system is reading your resume before any human does. These systems can determine who gets an interview and who gets silently rejected.

In this project, you will conduct a professional AI Impact Assessment on a fictional AI hiring screener, applying real regulatory frameworks to identify risks and propose safeguards for the people affected.

What You'll Build

You will produce a structured AI Impact Assessment document, a quantified risk register, and a published portfolio artifact that analyzes a high-risk AI resume screening system under the EU AI Act and NIST AI RMF.

By the end of this project, you'll have:

• A completed AI Impact Assessment document in Google Docs that classifies and analyzes a high-risk AI system using the NIST AI RMF structure (Govern, Map, Measure, Manage).
• A risk register in Google Sheets with severity and likelihood scoring that maps mitigation controls to identified risks.
• A published portfolio artifact on GitHub demonstrating AI governance competency to potential employers.
• Secret Mission: Extend your assessment with an EU AI Act Article 50 transparency compliance plan.

Are there any prerequisites?

None. This project includes all necessary context and framework explanations as you go. You only need a Google account and a GitHub account, both of which are free.

Before We Start

Before We Start...

Set Up Your Workspace

Before you can assess the risks of an AI system, you need a structured workspace. A professional AI Impact Assessment has multiple components that work together: a narrative document explaining your analysis, a quantitative register tracking each risk, and a repository where others can review your work.

In this step, you will create all three artifacts so they are ready to fill in as you work through the assessment framework.

In this step, get ready to:

• Create your AI Impact Assessment document in Google Docs with the NIST AI RMF section structure.
• Create your Risk Register spreadsheet in Google Sheets with scoring columns.
• Create a public GitHub repository to publish your governance artifacts as portfolio pieces.

Create your AI Impact Assessment document

The AI Impact Assessment document is where you will write the narrative analysis of the AI system. Its sections follow the NIST AI RMF structure so anyone reviewing your work can see which framework functions you applied.

• Open docs.google.com in your browser and sign into your Google account.
• Click Blank document to create a new document.
• Click the Untitled document text in the top left corner and rename it to AI Impact Assessment: TalentScreen AI.

Now add five section headers that you will fill in during later steps. Type each one on its own line and format it as Heading 2 using the styles dropdown in the toolbar:

• Type Section 1: System Description and Classification and set it to Heading 2.
• Press Enter and type Section 2: Stakeholder and Context Mapping (NIST AI RMF MAP). Set it to Heading 2.
• Press Enter and type Section 3: Risk Measurement and Evaluation (NIST AI RMF MEASURE). Set it to Heading 2.
• Press Enter and type Section 4: Risk Treatment and Mitigation Controls (NIST AI RMF MANAGE). Set it to Heading 2.
• Press Enter and type Section 5: Recommendations and Ongoing Monitoring. Set it to Heading 2.

Why these five sections?

Each section maps to a function of the NIST AI RMF. The framework gives your assessment a repeatable structure that governance teams recognize instantly.

Section 1 sets the scene. Sections 2 through 4 correspond to the Map, Measure, and Manage functions. Section 5 ensures the assessment does not become a one-time exercise.

Your document should now show five blue heading lines with no body text beneath them. Leave them empty for now.

Headers all look the same size as body text?

Make sure you are selecting Heading 2 from the styles dropdown (where it says Normal text by default), not just bolding the text manually.

If you accidentally typed body text, highlight the line, click the styles dropdown in the toolbar, and select Heading 2.

Help me format headings in Google Docs.

Create your Risk Register spreadsheet

A risk register is a structured table where each row represents one identified risk, scored by likelihood and severity. You will build this in Google Sheets so you can sort, filter, and calculate risk scores later.

• Open sheets.google.com in a new browser tab.
• Click Blank spreadsheet to create a new spreadsheet.
• Click the Untitled spreadsheet text in the top left corner and rename it to TalentScreen AI - Risk Register.

Now add the 11 column headers in Row 1. Click cell A1 and type each header into consecutive cells across the row:

• In cell A1, type Risk ID.
• In cell B1, type Risk Category.
• In cell C1, type Risk Description.
• In cell D1, type Affected Stakeholders.
• In cell E1, type Likelihood (1-5).
• In cell F1, type Severity (1-5).
• In cell G1, type Risk Score.
• In cell H1, type NIST RMF Subcategory.
• In cell I1, type Mitigation Control.
• In cell J1, type Control Owner.
• In cell K1, type Status.

Now format and freeze the header row so it stays visible as you add data:

• Select the entire Row 1 by clicking the row number 1 on the left edge.
• Click Format in the top menu bar, then click Bold. You can also press Cmd+B (macOS) or Ctrl+B (Windows).
• Click View in the top menu bar.
• Hover over Freeze, then click 1 row.

You should see a gray line appear below Row 1. This means the header row is frozen and will stay visible when you scroll down.

Why freeze the header row?

As you add risks in later steps, your spreadsheet will grow. Freezing keeps the column labels pinned at the top so you always know which column you are reading.

Don't see the Freeze option?

Make sure you are clicking View in the top menu bar (not Format). The Freeze option is nested under View.

Help me find the freeze option in Google Sheets.

Create your GitHub repository

Publishing your completed assessment to GitHub makes it a portfolio piece that hiring managers can review. A public repository signals that you can produce real governance artifacts, not just talk about frameworks.

• Open github.com in a new browser tab and sign into your GitHub account.
• Click the + icon in the top right corner, then click New repository.
• In the Repository name field, type ai-governance-portfolio.
• Leave the visibility set to Public.
• Check the box labeled Add a README file.
• Click Create repository.

GitHub will create the repository and show you its main page with a default README. Now update the README with a meaningful description:

• Click the pencil icon (Edit this file) on the README.md file.
• Replace all the existing content with the following text:

# AI Governance Portfolio

Portfolio of AI governance artifacts including impact assessments, risk registers, and policy documents.

• Click Commit changes (the green button in the top right).
• In the dialog that appears, leave the default commit message and click Commit changes again to confirm.

Your repository page should now display the heading and description you just wrote.

Repository name already taken?

If you already have a repository named ai-governance-portfolio from a previous attempt, either delete the old one (Settings > Danger Zone > Delete this repository) or choose a slightly different name like ai-governance-portfolio-v2.

Help me resolve a GitHub repository name conflict.

✔️ I've got all three artifacts set up

Excellent. You should now have three browser tabs open: your Google Doc with five section headers, your Google Sheet with 11 column headers in a frozen row, and your GitHub repository showing your updated README.

ⓧ I'd like to double check my setup

Verify each artifact matches the following:

• Google Doc titled AI Impact Assessment: TalentScreen AI with five Heading 2 lines: Section 1 (System Description and Classification), Section 2 (Stakeholder and Context Mapping - NIST AI RMF MAP), Section 3 (Risk Measurement and Evaluation - NIST AI RMF MEASURE), Section 4 (Risk Treatment and Mitigation Controls - NIST AI RMF MANAGE), and Section 5 (Recommendations and Ongoing Monitoring). No body text yet.
• Google Sheet titled TalentScreen AI - Risk Register with 11 column headers in Row 1 (Risk ID through Status), the row bolded, and a gray freeze line visible below it.
• GitHub repository named ai-governance-portfolio set to Public, with a README showing your portfolio description.

Your workspace is ready. Next up, you will fill in Section 1 by classifying TalentScreen AI under the EU AI Act and mapping its stakeholders using the NIST AI RMF MAP function.

Classify the AI System and Establish Context

Your workspace is ready with a structured document, a risk register, and a GitHub repository waiting for content. Now it is time to fill in the substance.

Every AI governance assessment starts with the same question: what exactly is this system, and why does it matter? In this step, you will classify TalentScreen AI under the EU AI Act risk framework and map out who is affected by the system using the NIST AI RMF MAP function.

In this step, get ready to:

• Classify TalentScreen AI as a high-risk system under the EU AI Act.
• Map stakeholders and deployment context using the NIST AI RMF MAP function.
• Document both the intended benefits and potential harms of the system.

Define the system and classify under EU AI Act

Before you can assess risks, you need to formally describe the system and determine where it falls in a regulatory framework. The EU AI Act uses a risk-based approach with four categories: unacceptable risk (prohibited), high risk (strict obligations), limited/transparency risk (disclosure requirements), and minimal or no risk (no specific rules).

• Switch back to your Google Doc titled AI Impact Assessment: TalentScreen AI.
• Click into Section 1: System Description and Classification.
• Write the following five fields below the section header:

**System Name:** TalentScreen AI

**System Description:** An AI-powered resume screening tool that uses natural
language processing to analyze, rank, and filter job applications. It assigns
each candidate a suitability score (0-100) and automatically advances
candidates above a threshold to the interview stage.

**Intended Purpose:** Recruitment and selection of natural persons, specifically
to analyse and filter job applications and to evaluate candidates.

**EU AI Act Classification:** High-Risk (Annex III, Area 4(a): "AI systems
intended to be used for the recruitment or selection of natural persons, in
particular to place targeted job advertisements, to analyse and filter job
applications, and to evaluate candidates")

**Applicable Obligations:** Article 9 (Risk Management System), Article 10
(Data Governance), Articles 13-14 (Transparency and Human Oversight),
Article 26(7) (Worker Information)

Why is this system classified as high-risk?

The EU AI Act (Regulation (EU) 2024/1689) lists specific use cases in Annex III that automatically qualify as high-risk. Area 4(a) covers AI systems used in recruitment and selection. Because TalentScreen AI filters job applications and evaluates candidates, it falls squarely into this category.

High-risk classification triggers strict obligations including mandatory risk management, data governance, transparency, and human oversight. These obligations are what your assessment will address.

What do the applicable obligations mean?

• Article 9 requires a risk management system (which is exactly what this assessment creates).
• Article 10 requires data governance measures to prevent biased training data.
• Articles 13-14 require transparency and human oversight so humans can understand and override the system.
• Article 26(7) specifically requires that workers and their representatives are informed when AI is used in employment decisions.

Map stakeholders and context

The NIST AI RMF MAP function establishes the context to frame risks related to an AI system. You need to identify everyone who interacts with or is affected by TalentScreen AI before you can assess what could go wrong.

• Scroll down to Section 2: Stakeholder and Context Mapping in your Google Doc.
• Write the following stakeholder and context mapping below the section header:

## Stakeholder and Context Mapping (NIST AI RMF MAP 1.1, MAP 5.1)

**Primary Users (deployers):** HR teams, hiring managers, talent acquisition
specialists

**Affected Individuals:** Job applicants (candidates), including protected
groups (based on gender, age, ethnicity, disability status)

**Organizational Context:** The deploying organization's mission, the specific
roles being hired for, and the volume of applications processed

**Deployment Setting:** Integrated into applicant tracking system (ATS), used
as first-pass filter before human review

**Applicable Laws and Norms:** EU AI Act, GDPR (data processing of personal
data), national anti-discrimination laws, organizational diversity and
inclusion policies

Why does MAP distinguish between users and affected individuals?

Primary users (HR teams) choose to use the system and have some control over it. Affected individuals (job applicants) have no choice in the matter. They are subject to the system's decisions without consenting to be evaluated by AI.

This distinction matters because the people with the least power over the system often bear the greatest risk. Your risk assessment needs to center the experience of affected individuals, not just the convenience of users.

Document intended benefits and potential harms

A balanced assessment acknowledges what the system is designed to achieve alongside what could go wrong. The NIST AI RMF MAP function (specifically MAP 3.1 and MAP 5.1) requires documenting both the likelihood and magnitude of beneficial and harmful impacts.

• Still in Section 2, add the following two subsections below the stakeholder mapping you just wrote:

### Benefits

- Faster processing of high-volume applications
- Consistency in initial screening criteria
- Reduced time-to-hire

### Potential Harms

- Discriminatory filtering based on proxies for protected characteristics
  (e.g., names, universities, gaps in employment history)
- Lack of transparency for rejected candidates
- Reduced access to employment opportunities for marginalized groups
- Perpetuation of historical hiring biases encoded in training data

What are proxy characteristics?

A proxy characteristic is a data point that correlates with a protected characteristic without naming it directly. For example, a candidate's university name can correlate with socioeconomic status or ethnicity. Gaps in employment history can correlate with gender (parental leave) or disability.

AI systems trained on historical hiring data often learn these proxy correlations because the training data reflects past human biases. This is one of the core risks your assessment will address in the next step.

• Review your completed Sections 1 and 2 to confirm all fields are filled in.
• Check that your document now has a clear system description, regulatory classification, stakeholder mapping, and both benefits and harms documented.

Adapt the content to your own analysis

The content provided above is a strong starting point. If you want to strengthen your portfolio artifact, add additional context based on your own reasoning. For example, you could expand the organizational context with a specific fictional company scenario, or add more potential harms you can think of.

✔️ Awesome, I've got everything!

Great. Make sure your Google Doc is saved (it should auto-save, but check for the cloud icon in the toolbar showing all changes are saved).

ⓧ I'd like to double check the full content

Here is what your completed Sections 1 and 2 should contain. Compare your document against this reference:

# Section 1: System Description and Classification

**System Name:** TalentScreen AI

**System Description:** An AI-powered resume screening tool that uses natural
language processing to analyze, rank, and filter job applications. It assigns
each candidate a suitability score (0-100) and automatically advances
candidates above a threshold to the interview stage.

**Intended Purpose:** Recruitment and selection of natural persons, specifically
to analyse and filter job applications and to evaluate candidates.

**EU AI Act Classification:** High-Risk (Annex III, Area 4(a): "AI systems
intended to be used for the recruitment or selection of natural persons, in
particular to place targeted job advertisements, to analyse and filter job
applications, and to evaluate candidates")

**Applicable Obligations:** Article 9 (Risk Management System), Article 10
(Data Governance), Articles 13-14 (Transparency and Human Oversight),
Article 26(7) (Worker Information)

# Section 2: Stakeholder and Context Mapping (NIST AI RMF MAP)

## Stakeholder and Context Mapping (NIST AI RMF MAP 1.1, MAP 5.1)

**Primary Users (deployers):** HR teams, hiring managers, talent acquisition
specialists

**Affected Individuals:** Job applicants (candidates), including protected
groups (based on gender, age, ethnicity, disability status)

**Organizational Context:** The deploying organization's mission, the specific
roles being hired for, and the volume of applications processed

**Deployment Setting:** Integrated into applicant tracking system (ATS), used
as first-pass filter before human review

**Applicable Laws and Norms:** EU AI Act, GDPR (data processing of personal
data), national anti-discrimination laws, organizational diversity and
inclusion policies

### Benefits

- Faster processing of high-volume applications
- Consistency in initial screening criteria
- Reduced time-to-hire

### Potential Harms

- Discriminatory filtering based on proxies for protected characteristics
  (e.g., names, universities, gaps in employment history)
- Lack of transparency for rejected candidates
- Reduced access to employment opportunities for marginalized groups
- Perpetuation of historical hiring biases encoded in training data

You now have a clear picture of what TalentScreen AI is, who it affects, and what is at stake. Next up, you will dig into the specific risks and assign severity scores in your risk register.

Assess and Score Risks

You have classified TalentScreen AI as high-risk and mapped its stakeholders and potential harms. Now you need to turn those general harms into specific, measurable risks that an organization can act on.

The NIST AI RMF MEASURE function provides a structured way to do this. It uses trustworthiness characteristics (fairness, transparency, privacy, validity, safety) as lenses for identifying what can go wrong. You will score each risk by likelihood and severity, giving decision-makers a clear picture of where to focus resources.

In this step, get ready to:

• Identify risks across NIST trustworthiness characteristics.
• Score and quantify each risk in your risk register.
• Write a prioritized risk summary explaining which risks are most critical.

Identify risks across trustworthiness characteristics

The NIST AI RMF defines seven characteristics of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy enhanced, and fair with harmful biases managed. Each characteristic is a lens for asking "what could go wrong?" with TalentScreen AI.

For this assessment, you will focus on five characteristics that are most relevant to a hiring system. Each one maps to a specific MEASURE subcategory in the framework.

• Return to your Google Doc titled "AI Impact Assessment: TalentScreen AI."
• Scroll down to Section 3: Risk Measurement and Evaluation (NIST AI RMF MEASURE).
• Under the section heading, add a subheading called Identified Risks by Trustworthiness Characteristic.

Below that subheading, document the following five risks. For each one, write the trustworthiness characteristic, the MEASURE subcategory, and a one-sentence risk description.

• Fairness and Bias (MEASURE 2.11): The system may discriminate against candidates from underrepresented groups due to biased training data from historical hiring decisions.
• Transparency and Accountability (MEASURE 2.8): Candidates cannot understand why they were rejected because the scoring algorithm is not explainable.
• Privacy (MEASURE 2.10): The system processes sensitive personal data (employment history, education, potentially inferring protected characteristics) without adequate data minimization.
• Validity and Reliability (MEASURE 2.5): The system may not generalize well across different job types, industries, or candidate populations.
• Safety (MEASURE 2.6): Incorrect rejections at scale can systematically exclude qualified candidates, causing widespread harm to livelihoods.

What is the MEASURE function?

The NIST AI RMF MEASURE function "employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk and related impacts." It takes the context you established in MAP and turns it into specific, evaluable risk statements.

Each MEASURE subcategory (like 2.11 for fairness or 2.8 for transparency) gives you a structured question to ask about your AI system. This prevents you from overlooking risks that a purely intuitive review might miss.

Score risks in your risk register

Identifying risks is only useful if you can compare them. A likelihood-times-severity scoring model lets you rank risks objectively and decide which ones demand immediate attention versus ongoing monitoring.

• Switch back to your Google Sheets spreadsheet titled "TalentScreen AI - Risk Register."
• In Row 2, enter the first risk with these values:

• Risk ID: RISK-001
• Risk Category: Bias
• Risk Description: Training data encodes historical hiring discrimination against women in technical roles
• Affected Stakeholders: Job applicants (women)
• Likelihood (1-5): 4
• Severity (1-5): 5
• Risk Score: 20 (Likelihood x Severity = 4 x 5).
• NIST RMF Subcategory: MEASURE 2.11
• Leave Mitigation Control, Control Owner, and Status blank. You will fill these in the next step.

Why is bias scored so high?

RISK-001 gets a Likelihood of 4 ("likely") because research consistently shows that AI systems trained on historical hiring data replicate the biases present in that data. If a company historically hired fewer women in technical roles, the model learns to associate male-correlated resume features with success.

It gets a Severity of 5 ("catastrophic") because the harm is denial of employment opportunity. This is a fundamental rights impact, which is precisely why the EU AI Act classifies employment AI as high-risk.

• In Rows 3 through 6, enter the remaining four risks. Use the values below.

Row 3 (RISK-002):

• Risk Category: Transparency
• Risk Description: Candidates cannot understand why they were rejected; the scoring algorithm is not explainable
• Affected Stakeholders: Job applicants
• Likelihood: 5 | Severity: 4 | Risk Score: 20
• NIST RMF Subcategory: MEASURE 2.8

Row 4 (RISK-003):

• Risk Category: Privacy
• Risk Description: Processes sensitive personal data without adequate data minimization
• Affected Stakeholders: Job applicants
• Likelihood: 3 | Severity: 4 | Risk Score: 12
• NIST RMF Subcategory: MEASURE 2.10

Row 5 (RISK-004):

• Risk Category: Validity
• Risk Description: System may not generalize across job types or candidate populations
• Affected Stakeholders: Job applicants
• Likelihood: 3 | Severity: 4 | Risk Score: 12
• NIST RMF Subcategory: MEASURE 2.5

Row 6 (RISK-005):

• Risk Category: Safety
• Risk Description: Incorrect rejections at scale systematically exclude qualified candidates
• Affected Stakeholders: Job applicants broadly
• Likelihood: 4 | Severity: 4 | Risk Score: 16
• NIST RMF Subcategory: MEASURE 2.6

How does the scoring scale work?

The 1-5 scales are: Likelihood (1 = Very Unlikely, 2 = Unlikely, 3 = Possible, 4 = Likely, 5 = Almost Certain) and Severity (1 = Negligible, 2 = Minor, 3 = Moderate, 4 = Major, 5 = Catastrophic).

Multiplying them gives a Risk Score from 1 to 25. Scores of 15 or above are typically flagged as high-priority, meaning they need active mitigation controls rather than just monitoring.

Add more risks if you can

Five risks is the minimum for this project. In professional practice, a risk register for a high-risk AI system often contains 15-30 entries. If you can think of additional risks (e.g., model drift over time, adversarial manipulation of resumes, or unequal performance across languages), add them as rows 7 and beyond.

Prioritize risks and write your summary

A risk register full of numbers is a starting point. Decision-makers also need a written narrative that explains which risks matter most, who faces the greatest harm, and how risks interact with each other.

• Return to your Google Doc.
• Below the risk identification content you added earlier in Section 3, add a new subheading called Prioritized Risk Summary.
• Write 3-5 sentences that address the following three points:

• Which risks scored highest and why. RISK-001 (Bias) and RISK-002 (Transparency) both scored 20 out of 25, making them the highest-priority risks. Bias is likely because the training data reflects decades of unequal hiring. Lack of transparency is almost certain because NLP-based scoring models are inherently difficult to explain in plain language.
• Which stakeholder group faces the most concentrated harm. Job applicants from underrepresented groups bear the greatest risk. They are the ones who are filtered out by biased algorithms and simultaneously denied any explanation for the decision.
• How the risks interact. Bias combined with a lack of transparency creates a compounding effect. Affected candidates cannot challenge discriminatory outcomes because they have no visibility into the reasoning behind their rejection.

Why does interaction between risks matter?

In professional AI governance, risks are rarely isolated. A system that is both biased AND opaque is far more harmful than one that is biased but transparent (because transparency enables correction). Noting these interactions in your assessment shows that you understand systemic risk, not just individual failure modes.

Not sure what to write?

Your summary does not need to be perfect prose. The goal is to translate numbers into a narrative that a non-technical executive could understand. Focus on answering: "If I could only fix two things, which two risks would I fix and why?"

Help me write a risk prioritization summary for my AI Impact Assessment.

Your risk register now has quantified scores and your Google Doc explains why those scores matter. Next up, you will propose specific mitigation controls for each risk and write your final recommendations.

Propose Mitigation Controls and Document Recommendations

Your risk register now quantifies exactly where TalentScreen AI poses the greatest danger to candidates. Identifying and scoring risks is only half the work.

In this step, you will apply the NIST AI RMF MANAGE function to propose specific controls for each risk, then document your full recommendations and ongoing monitoring plan in Sections 4 and 5 of your assessment.

In this step, get ready to:

• Assign specific mitigation controls to each risk in your register.
• Write the risk treatment plan in Section 4 of your assessment.
• Document ongoing monitoring and accountability in Section 5.

Assign mitigation controls in your risk register

The NIST AI RMF MANAGE function is where risks get responded to with concrete actions. Each risk in your register needs a specific, actionable control that reduces either its likelihood or its severity.

What is the MANAGE function?

According to the NIST AI RMF, the MANAGE function is where "AI risks based on assessments and other analytical output from the Map and Measure functions are prioritized, responded to, and managed."

In practice, this means taking each scored risk and assigning a control that directly addresses the harm. A good mitigation control is specific enough that someone could implement it without further research.

• Switch back to your TalentScreen AI - Risk Register spreadsheet in Google Sheets.
• Click the Mitigation Control cell (column I) for RISK-001.
• Type the following mitigation: Conduct regular bias audits using disaggregated metrics across protected characteristics; retrain model on balanced datasets; implement disparate impact testing before deployment.
• In the Control Owner cell (column J), type AI Development Team.
• In the Status cell (column K), type Proposed.

Now fill in the remaining risks. Use the following as guidance for each row.

• For RISK-002 (Transparency), enter this mitigation: Provide candidates with a clear explanation of how their application was assessed per Article 86 (Right to Explanation); publish summary information about the system's logic. Set the owner to HR Compliance and status to Proposed.
• For RISK-003 (Privacy), enter this mitigation: Implement data minimization; process only information directly relevant to job requirements; conduct GDPR Data Protection Impact Assessment alongside this AIIA. Set the owner to Data Protection Officer and status to Proposed.
• For RISK-004 (Validity), enter this mitigation: Conduct regular performance evaluations across job types and demographic groups; establish minimum accuracy thresholds. Set the owner to AI Development Team and status to Proposed.
• For RISK-005 (Safety), enter this mitigation: Implement human review override for all rejections above a volume threshold; establish appeals process for candidates. Set the owner to AI Governance Committee and status to Proposed.

Why specific controls matter

Notice that each mitigation names a concrete action ("conduct bias audits using disaggregated metrics") rather than a vague aspiration ("reduce bias"). A control owner reading this register should be able to begin implementation without needing to ask what it means.

The "Proposed" status indicates these controls have been identified but not yet implemented. In a real organization, controls move through Proposed, In Progress, Implemented, and Verified stages.

Verify that every row in your risk register now has values in the Mitigation Control, Control Owner, and Status columns. No cells in those three columns should be blank.

Write the risk treatment plan in Section 4

Your risk register captures the raw data. Section 4 of your assessment translates that data into a narrative that decision-makers can act on.

• Switch back to your Google Doc and scroll to Section 4: Risk Treatment and Mitigation Controls (NIST AI RMF MANAGE).
• Identify your high-priority risks. These are any risks with a score of 15 or higher. From your register, RISK-001 (score 20), RISK-002 (score 20), and RISK-005 (score 16) qualify.

For each high-priority risk, write 2-3 sentences covering the proposed control, who is responsible, and when it should be implemented. Use the following structure as a guide.

• For RISK-001 (Bias), write about the bias audit approach: regular audits using disaggregated metrics across protected characteristics, retraining on balanced datasets, and disparate impact testing before deployment. Assign to the AI Development Team with implementation before initial deployment. Map this control to EU AI Act Article 9 (Risk Management System).
• For RISK-002 (Transparency), write about providing candidates with a clear explanation of how their application was assessed per Article 86 (Right to Explanation) and publishing a summary of the system's logic. Assign to HR Compliance with implementation within 30 days of deployment. Map this control to Articles 13-14 (Transparency and Human Oversight).
• For RISK-005 (Safety), write about implementing a human review override for rejections above a volume threshold and establishing a candidate appeals process. Assign to the AI Governance Committee with implementation concurrent to deployment. Map this control to Article 9 (Risk Management System).

• After documenting all three high-priority risks, add a final paragraph noting any risks where the proposed mitigation may be insufficient. For example, the transparency control for RISK-002 may not fully satisfy candidates who want to challenge their outcome. Flag this for escalation to legal counsel.

Why map controls to EU AI Act articles?

Mapping each mitigation control to a specific regulatory article demonstrates that your risk treatment is not just good practice. It is a compliance response to a binding legal obligation. This is what auditors and regulators look for when reviewing an AI Impact Assessment.

Keep controls traceable

Reference your Risk IDs (RISK-001, RISK-002, RISK-005) in Section 4 so readers can trace each recommendation directly back to the scored risk in your register. This traceability is a hallmark of professional governance documents.

Write the ongoing monitoring section

A risk assessment is not a one-time exercise. AI systems change over time as they are retrained, expanded to new use cases, or exposed to shifting populations. Section 5 defines how the organization maintains oversight after deployment.

• Scroll to Section 5: Recommendations and Ongoing Monitoring in your Google Doc.

Document three subsections: monitoring frequency, trigger conditions, and accountability. Use the following guidance for each.

• Under a Monitoring Frequency heading, write that the system should undergo quarterly bias audits, an annual full AIIA review, and continuous performance monitoring of key metrics (rejection rates, score distributions across demographic groups).
• Under a Trigger Conditions heading, list the events that should prompt an immediate reassessment: model retraining, expansion to new job categories, complaints from candidates, and changes in regulatory guidance.
• Under an Accountability heading, state that the AI Governance Committee (or equivalent) has final authority to halt deployment if risks exceed the organization's tolerance. Name this body explicitly so there is no ambiguity about who makes the stop/go decision.

Why define trigger conditions?

Scheduled reviews (quarterly, annual) catch gradual drift. Trigger conditions catch sudden changes. If the model is retrained on new data, its bias profile may shift overnight. Defining these triggers in advance prevents the "we'll revisit it someday" trap that leads to stale assessments.

Review your completed Sections 4 and 5. Section 4 should have 2-3 sentences per high-priority risk plus an escalation note. Section 5 should have three clearly labeled subsections.

Your assessment now has teeth. You have moved from identifying risks to prescribing exactly how the organization should respond and who is accountable. In the next step, you will package everything and publish it to GitHub as a portfolio artifact.

Publish to GitHub

Your assessment is complete. You have a structured document covering system classification, stakeholder mapping, risk evaluation, mitigation controls, and ongoing monitoring. Now it is time to turn these into a portfolio artifact that hiring managers can find.

In this step, you will export your documents in shareable formats and publish them to your GitHub repository. A public repository with governance artifacts signals hands-on competency far more effectively than listing frameworks on a resume.

In this step, get ready to:

• Export your Google Doc and Google Sheet in portfolio-ready formats.
• Upload your assessment files to GitHub.
• Update your README with project context and framework references.

Export and format your documents

GitHub displays Markdown files directly and lets visitors download other file types. You will export three versions: a PDF for polished reading, a CSV for the raw risk data, and a Markdown file for inline viewing on GitHub.

• Switch back to your Google Doc ("AI Impact Assessment: TalentScreen AI").
• Click File in the top menu bar.
• Hover over Download.
• Select PDF Document (.pdf).
• Save the file as ai-impact-assessment-talentscreen.pdf.

Now export the same document as Markdown for inline viewing on GitHub.

• Click File again, then hover over Download.
• Select Markdown (.md).
• Save the file as ai-impact-assessment-talentscreen.md.

Finally, export your risk register as a CSV.

• Switch to your Google Sheet ("TalentScreen AI - Risk Register").
• Click File in the top menu bar.
• Hover over Download.
• Select Comma Separated Values (.csv).
• Save the file as risk-register-talentscreen.csv.

You should now have three files in your Downloads folder: ai-impact-assessment-talentscreen.pdf, ai-impact-assessment-talentscreen.md, and risk-register-talentscreen.csv.

Don't see the Markdown option?

Google Docs may list this option as Markdown (.md) further down in the Download submenu. Scroll to the bottom of the list if you do not see it immediately.

Help me find the Markdown export option in Google Docs

Upload your files to GitHub

• Return to your ai-governance-portfolio repository on GitHub.
• Click Add file near the top of the repository page.
• Select Upload files.
• Drag or select your three files: ai-impact-assessment-talentscreen.pdf, ai-impact-assessment-talentscreen.md, and risk-register-talentscreen.csv.
• In the Commit changes section at the bottom, replace the default message with: Add TalentScreen AI Impact Assessment and Risk Register.
• Click Commit changes.

GitHub returns you to the repository's main page. You should see all three files listed alongside your existing README.md.

Why three formats?

The PDF gives readers a polished, print-ready version. The Markdown file renders directly in the GitHub browser view, so visitors can read your assessment without downloading anything. The CSV preserves the structured risk data in a format that other tools (spreadsheets, databases, GRC platforms) can import.

Files not appearing after commit?

Make sure you clicked Commit changes (not just the file upload). If the page still shows only the README, refresh the browser.

Help me troubleshoot files not showing in my GitHub repository

Update your README with project context

A well-written README turns a file dump into a professional portfolio piece. It tells visitors what the project is, what frameworks you applied, and what each file contains.

• Click on README.md in your repository file list.
• Click the pencil icon (edit button) in the top-right corner of the file preview.
• Replace the existing content with an updated README that includes the sections described below.

Your README should include these four sections:

• Project description: 2-3 sentences explaining that this repository contains an AI Impact Assessment for a high-risk AI hiring system (TalentScreen AI), analyzing risks to job applicants and proposing mitigation controls.
• Frameworks applied: List the NIST AI RMF (Map, Measure, Manage functions) and the EU AI Act (high-risk classification under Annex III, Area 4).
• File listing: A brief explanation of what each file contains (ai-impact-assessment-talentscreen.pdf, ai-impact-assessment-talentscreen.md, risk-register-talentscreen.csv).
• Frameworks Referenced: List the following three standards: NIST AI RMF 1.0 (NIST AI 100-1), EU AI Act Regulation (EU) 2024/1689, ISO/IEC 42001.

Use Markdown headings

Use ## for each section heading in your README. GitHub renders these as formatted headers, making your repository look polished and scannable.

• Once you have written your updated README, click Commit changes in the top-right corner.
• In the commit dialog, leave the default message or write something like Update README with project description and framework references.
• Click Commit changes to save.

Your repository's main page now displays the formatted README with all four sections visible. Scroll down to confirm each section renders with its heading and content.

Why include ISO/IEC 42001?

ISO/IEC 42001 is the first international standard for AI management systems. Listing it in your references signals awareness of the broader governance landscape, even though this project focuses on NIST AI RMF and EU AI Act compliance.

README not rendering properly?

Check that your headings have a space between the ## and the heading text. Also make sure there is a blank line before each heading. GitHub Markdown requires these for correct rendering.

Help me fix my GitHub README formatting

Secret mission

Add an EU AI Act Article 50 Transparency Compliance Plan

The EU AI Act's Article 50 transparency obligations took effect on 2 August 2026. TalentScreen AI interacts directly with candidates and sends automated communications. Can you determine exactly which transparency obligations apply and design a compliance plan that satisfies them?

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely on free, browser-based tools (Google Docs, Google Sheets, and GitHub), so there are no ongoing costs.

Resources you used:

• Google Doc: "AI Impact Assessment: TalentScreen AI" (Sections 1-6).
• Google Sheets: "TalentScreen AI - Risk Register" spreadsheet.
• GitHub repository: ai-governance-portfolio (public, containing PDF, CSV, Markdown, and README).

Keep everything running

No action needed. Choose this if you plan to continue refining your assessment, adding new governance artifacts, or sharing your portfolio with potential employers.

• Your Google Doc and Google Sheets remain in your Google Drive at no cost.
• Your GitHub repository stays public and viewable by anyone with the link.
• You can continue updating these documents as you learn more about AI governance frameworks.

Pause - I'll come back to this later

Since all resources are free and stored in the cloud, there is nothing to pause. Your documents remain accessible whenever you return.

• If you want to reduce visibility temporarily, you can set your GitHub repository to private. Go to your repository page, click Settings, scroll down to the Danger Zone section, and click Change visibility.
• Your Google Drive files remain accessible only to you unless you have shared them.

Delete - I don't want to use this again

Remove all project resources permanently. Only choose this if you are sure you will not need these artifacts again.

• Delete the Google Doc: Open Google Drive, right-click "AI Impact Assessment: TalentScreen AI", and select Move to trash. Then open Trash and click Empty trash to permanently remove it.
• Delete the Google Sheet: In Google Drive, right-click "TalentScreen AI - Risk Register" and select Move to trash. Empty your trash to permanently delete it.
• Delete the GitHub repository: Navigate to your ai-governance-portfolio repository on GitHub. Click Settings. Scroll down to the Danger Zone section. Click Delete this repository and follow the confirmation prompts.
• Delete any local copies of the exported PDF, CSV, or Markdown files you may have downloaded to your computer.

Nice Work!

Nice Work!

You just completed a professional AI Impact Assessment on a high-risk AI system. This is the exact kind of deliverable that AI governance teams produce when evaluating whether an AI system is safe and compliant to deploy.

Here's what you accomplished:

• Classified an AI system under the EU AI Act risk-based framework and identified it as high-risk under Annex III, Area 4.
• Applied the NIST AI RMF structure (Map, Measure, Manage) to systematically identify, score, and propose mitigation controls for AI risks.
• Published a portfolio-ready governance artifact to GitHub, including a complete impact assessment document and a quantified risk register with severity and likelihood scoring.
• Secret Mission: Designed an Article 50 transparency compliance plan addressing the obligations that took effect August 2026.

Ready to quiz yourself?