The organization should establish a process for assessing the potential impacts of AI systems on individuals, groups, and society throughout their entire lifecycle. This process should define how impacts are identified, analyzed, evaluated, and mitigated, and how these assessments are reviewed and updated regularly.

When conducting a fundamental rights impact assessment for a high-risk AI system, the organization shall identify specific risks of harm that the use of the system may pose to natural persons or groups of persons. This identification should be based on the categories of persons already identified as potentially impacted by the AI system.

The assessment of specific risks shall also consider relevant information provided by the AI system provider, including data on potential risks and any proposed mitigation measures. The identified specific risks and their potential impact should be thoroughly documented as a key part of the fundamental rights impact assessment.