Obligations
A dozen US states now require a documented assessment before certain processing. They agree that an assessment should exist and disagree about almost everything else — which is why a single national document is the wrong artefact.
Where they agree, and where they do not
Averaging across statutes produces a document that is plausible everywhere and precisely correct nowhere.
They agree that some processing needs an assessment
The shared idea: certain higher-risk processing should be documented and weighed before it happens, and produced to the attorney general on request.
They diverge on what triggers one
Targeted advertising, sale of personal data, profiling with legal or similarly significant effects, and sensitive-data processing appear in different combinations with different thresholds.
They diverge on required contents
What must be weighed, against what, and how explicitly the balancing must be recorded differs statute to statute.
They diverge on retention and production
How long you keep it, and the circumstances in which it must be produced, are not uniform — and neither is what happens to privilege when it is.
This page cannot answer the question for you. It sets out the questions that decide it. Whether a duty attaches to a particular deployment depends on facts specific to your organisation, and whether your position is adequate is a judgement for your counsel. Nothing here is legal advice. Which states reach your deployment, and what each requires, is a determination about your actual footprint.
Scope discipline
Obligations attach by where the person is. A deployment reaching residents of three states needs three assessments — and buying twelve is money spent on documents nobody will ever ask for.
Equally, assuming you touch one state because that is where you are incorporated is how organisations discover the other eleven at the worst moment.
Footprint first
Establish where the affected people actually are, and the assessment requirement follows from that rather than from a guess.