feat(agents): Responsible AI Impact Assessment Agent

[jayachithra]

Custom Agent Name

/rai-impact-assessment-creator

Type

Custom Agent

Purpose

Responsible AI (RAI) Impact Assessment is a critical process for any project involving AI. It helps teams identify potential misuse scenarios, understand possible harms to different stakeholders, and define appropriate mitigations early in the lifecycle of an AI system.

Microsoft recommends conducting Impact Assessments as early as possible, once the use case is clear, so that risks can be addressed proactively rather than reactively. However, performing a thorough assessment can be time-consuming and often depends on having deep RAI expertise available at the right time.

An RAI Impact Assessment agent would support this process by analyzing a project’s use case, systematically identifying potential harms, affected stakeholders, and possible mitigations. The agent’s output - an initial Impact Assessment document - can serve as a strong starting point for team discussions, reviews, and refinement, helping teams move faster while maintaining high Responsible AI standards.

Requirements

The RAI Impact Assessment agent should:

• Demonstrate deep understanding of Microsoft’s Responsible AI Standards and Principles and apply them consistently across assessments.
• Ingest and reason over a project’s use case, including its context, users, and deployment environment. Ask clarifying questions to the user to gather more information if needed.
• Generate a comprehensive Responsible AI Impact Assessment document.
• Identify and clearly articulate:
  1. Different intended uses and possible misuses of the system
  2. Potential benefits and harms of the system across different stakeholder groups.
  3. Preliminary mitigation strategies for identified harms, grounded in RAI best practices.

The output should be structured, actionable, and suitable as a starting point for team reviews, workshops, and further refinement.

[WilliamBerryiii]

@jayachithra - how do you see this interplaying with threat models and should part of the output from this agent be recommended updates to a project's threat models? In this project we include our RAI review as a sub-section in the threat model ... just curious of your opinions so we can start to spec something.

[jayachithra]

@WilliamBerryiii Thanks for raising it. I think it would be best to keep the RAI Impact Assessment agent as a separate workflow but feeding the findings from this agent into the security pan creator.

The way I see it, security plan creator focuses on system-centric threats, but the RAI agent:

1. Focuses primarily on human-centric harms by analyzing how the system's use impacts the Stakeholders (even when the system works as expected)
2. Targets additional threat categories that might be caused by unintended use of the AI system - like risks to fairness, accountability, transparency etc.

I have the following proposal for integration with the threat modelling agent:
RAI Assessment agent:

1. Ingests project documents and generates a comprehensive Impact Assessment plan
2. Identifies and maps threats to the existing threat categories if possible and adds a new category for other AI/ML threats that don't map to existing categories

Security Plan Agent:

1. Adds a new threat category in the existing threat modelling framework (for example AI/ML security), which applies to all AI/ML based projects
2. Imports all AI/ML specific threats from RAI Impact Assessment plan
3. Extends security plan with: AI-specific threat annotations in the Data flow diagrams and attributes, extends threats and mitigations/guardrails with imported AI specific threats and mitigations
4. Flags AI projects without RAI assessment for review

If you agree, I can raise a PR with my initial idea. What do you think?

[WilliamBerryiii]

Thanks for proposing this, @jayachithra. The RAI Impact Assessment agent is a valuable addition — generating structured impact assessments grounded in Microsoft's RAI Standards addresses a real gap in early-stage risk identification.

We've consolidated this issue with #91 (Responsible AI Agent for Accessibility and Compliance by @niksacdev) into a unified design discussion. The two proposals cover complementary stages: yours focuses on planning-time risk assessment (identifying misuses, stakeholder harms, mitigations) while #91 focuses on implementation-time code compliance (WCAG 2.1, bias detection, privacy controls). Together they form a complete RAI story.

Your requirements around interactive clarifying questions, stakeholder harm analysis, and structured output are carried forward as key design inputs in the discussion.

Please head over to the Discussions tab to find "Design: Responsible AI Agent — Code Compliance + Impact Assessment" — we'd love your continued input there.

Closing this issue in favor of the consolidated discussion.