An AI impact assessment examines how an AI system could affect individuals, groups of people and society. ISO/IEC 42001 requires one, and ISO/IEC 42005, published in 2025, gives guidance on how to carry it out. This guide explains what to assess, when, and how the result fits with your risk assessment and privacy work.
Key points
- ISO/IEC 42001 requires an AI system impact assessment (clause 6.1.4 and the controls in Annex A.5).
- ISO/IEC 42005:2025 is guidance, not a set of requirements. You cannot be certified against it.
- An AI impact assessment looks outward, at people and society. A risk assessment looks at the organization’s objectives.
- Assess before deployment, and again when the system, its data or its use changes.
- Keep the result as documented information; auditors will ask for it.
What an AI impact assessment is
An AI impact assessment is a structured way to identify, evaluate and record the consequences an AI system may have for the people it touches. That includes intended use and reasonably foreseeable misuse, and it covers benefits as well as harms.
Typical questions: Who is affected by the system’s output? Could it treat groups differently? What happens to a person when it is wrong? Can that person find out, object or get a human decision?
What ISO/IEC 42001 requires
Clause 6.1.4 requires the organization to define a process for assessing the potential consequences of AI systems for individuals, groups and societies, and to consider the results in its risk assessment. Annex A.5 adds four controls:
- A.5.2 a process for AI system impact assessment
- A.5.3 documentation of the assessments
- A.5.4 assessing the impact on individuals and groups of individuals
- A.5.5 assessing societal impacts
The standard does not prescribe a template. That is the gap ISO/IEC 42005 fills.
How ISO/IEC 42005 helps
ISO/IEC 42005 gives guidance in two parts. The first is about the process: when to assess, how to set the scope, who is responsible, what thresholds trigger a deeper review, how results are approved, and how they are monitored. The second is about what to document:
- the AI system: its purpose, intended uses and foreseeable misuse
- the data: sources, quality and known limitations
- the algorithms and models used
- the deployment environment, including geography, language and legal context
- the interested parties who are affected
- the actual and foreseeable benefits and harms
- the measures taken to address harms
AI impact assessment step by step
- List your AI systems. You cannot assess what you have not inventoried. Include AI features inside purchased software.
- Screen each one. A short set of questions decides which systems need a full assessment. A spelling checker and a hiring tool do not deserve the same effort.
- Describe the system and its context. Purpose, users, affected people, data and where it runs.
- Identify impacts. Work through areas such as fairness, safety, privacy, transparency, accountability, and effects on employment, the environment or access to services.
- Evaluate them. Consider how severe, how likely, how many people, and whether the effect can be reversed.
- Decide on measures. Change the design, limit the use, add human review, improve the data, or do not deploy.
- Record and approve. Someone with authority signs off. Feed the result into the AI risk assessment.
- Review. Repeat at planned intervals and when something material changes.
AI impact assessment vs risk assessment vs DPIA
| Assessment | Looks at | Comes from |
|---|---|---|
| AI impact assessment | Effects on individuals, groups and society | ISO/IEC 42001, guided by ISO/IEC 42005 |
| AI risk assessment | Effects on the organization’s objectives | ISO/IEC 42001, guided by ISO/IEC 23894 |
| Data protection impact assessment (DPIA) | Risks to people from processing personal data | GDPR Article 35 |
| Fundamental rights impact assessment | Effects of a high-risk AI system on fundamental rights | EU AI Act Article 27, for certain deployers |
These overlap. Many organizations run them together with one questionnaire, so the same facts are collected once. That is acceptable as long as each requirement is visibly covered.
Common mistakes
- Assessing only systems built in-house and ignoring AI bought from suppliers.
- Treating the assessment as a one-time form completed after launch.
- Asking only the technical team, with nobody representing the people affected.
- Recording harms without recording what was decided about them.
Learn to run it properly
Impact assessment is covered in ISO/IEC 42001 Lead Implementer, for those who design the process, and in ISO/IEC 42001 Lead Auditor, for those who check it. If AI risk is your main responsibility, look at Lead AI Risk Manager. For the standard as a whole, see our ISO/IEC 42001 certification guide.
Sources: ISO/IEC 42005:2025, AI system impact assessment and ISO/IEC 42001:2023 (ISO).
Frequently asked questions
Is an AI impact assessment mandatory?
It is required if you implement ISO/IEC 42001. Under the EU AI Act, certain deployers of high-risk systems must carry out a fundamental rights impact assessment. Other laws may add their own requirements.
Can we be certified to ISO/IEC 42005?
No. ISO/IEC 42005 is a guidance standard. Organizations are certified to ISO/IEC 42001, and the impact assessment is one of the things the auditor examines.
How is an AI impact assessment different from a DPIA?
A DPIA covers risks from processing personal data under the GDPR. An AI impact assessment is wider: it covers fairness, safety, transparency and societal effects, including for systems that use no personal data.
How often should an AI impact assessment be repeated?
At planned intervals, and whenever the system, its data, its users or its purpose changes in a way that could alter the impacts.
