The IAMA is the human rights impact assessment Dutch public bodies carry out before they put an algorithm to work. A shorter version published in February 2026 is built to meet the fundamental rights impact assessment required by Article 27 of the EU AI Act.
For much of the public sector, that turns the exercise into a legal duty. Anyone deploying a high-risk AI system for a public task will soon have to show they have done one.
What is the IAMA?
IAMA stands for Impact Assessment Mensenrechten en Algoritmes, or human rights and algorithms impact assessment. Utrecht University developed it in 2021 for the Dutch Ministry of the Interior. According to the Dutch government's algorithm framework, its purpose is to weigh the risks to fundamental rights before an algorithm goes live. It covers AI systems and simpler algorithms alike, such as a scoring rule that decides which applications get a second check.
The framework is explicit that the IAMA is a structured discussion between people from different disciplines, ending in advice to whoever decides on deployment. It is not meant to be ticked off as a checklist.
What changed in the February 2026 version?
The Dutch government published a revised IAMA in February 2026, drawing on feedback from users. It is shorter, comes with a separate explanatory document, and flags every question that maps onto Article 27 of the AI Act with its own icon.
The assessment has five parts. It opens with the why: the reason for the algorithm, its aims, the public values at stake, the legal basis and who is responsible. The what comes next, covering the type of algorithm, how it is built, its quality and accuracy, and data governance and security. Part three looks at how it will be used in practice, including the role of the staff member who acts on the output, communication, monitoring and the effect on citizens. Fundamental rights themselves arrive in part four, tested for severity, effectiveness, necessity and subsidiarity. Part five weighs it all up and records the advice and residual risks.
When is a rights impact assessment mandatory?
The IAMA itself is not a legal requirement. The Dutch framework recommends it for high-risk AI systems and for algorithms with a significant effect on citizens.
The legal duty comes from the AI Act. Article 27 requires deployers of high-risk AI systems that are bodies governed by public law, or private entities providing public services, to carry out a fundamental rights impact assessment before first use. The same applies to anyone using AI to assess people's creditworthiness or to price and assess risk in life and health insurance, categories 5(b) and 5(c) of Annex III. Banks and insurers are therefore in scope too. Systems used for critical infrastructure are exempt.
The assessment has to describe the process the system supports, how long and how often it will be used, which groups of people may be affected, the specific risks of harm, how human oversight works and what happens if those risks materialise, including complaint handling. The results go to the market surveillance authority.
The timetable has moved this year. Under the Digital Omnibus on AI, in force since 27 July 2026, the high-risk rules for Annex III systems now apply from 2 December 2027. That sounds comfortably distant until you work backwards: an algorithm going live in 2027 is being designed now, and design is exactly when this assessment earns its keep.
How does the IAMA relate to a DPIA?
The two overlap. A data protection impact assessment deals with high-risk processing of personal data, while the IAMA looks at the full range of fundamental rights, including equal treatment. Article 27 lets deployers reuse relevant parts of an existing DPIA, and the Dutch Ministry of the Interior has published guidance on running its standard government DPIA model alongside the IAMA. Run them as one exercise, with one team and one timeline.
Who should be in the room?
The IAMA assumes a team of four to seven people, led by a facilitator and ideally working together on site. It names a project lead, a data scientist and a lawyer as a minimum, and calls the lawyer indispensable for the fundamental rights section.
The time commitment is modest. The document suggests a two-hour session for the first two parts, another two hours for part three and the start of part four, research by the lawyer, and a final one-hour session. The advice then goes to a manager or elected official, who takes the decision and accepts the residual risks.
My advice is not to hand the IAMA to the privacy or legal team alone. Because the subject is rights, that is the obvious place to park it. Yet a large share of the questions are about how the system works: what data goes in, how accurate it is, how it is secured and what happens if someone manipulates the output. So bring in someone who understands the system technically. That might be the data scientist who built it. For a system bought in from a vendor, an AI security specialist is often the better choice, because they know what to ask the supplier.
If you are still dividing responsibilities between your data protection officer and your privacy officer, I have written about why those roles are best kept separate. The same logic applies here: the DPO oversees the assessment but should not be the one writing it.
Where to start
Draw up a list of the algorithms you use or are building, and check each one against Annex III. For new systems, schedule the assessment during design, well before go-live. Then take stock of the skills you have in house. If the technical side is missing, that is the obvious gap to fill with temporary expertise.
We find specialists in AI security and privacy and data protection, and our page on the public sector explains how we support government clients. Want to talk through who you need for an IAMA? Call or email me.
