ISO/IEC 42005 — AI System Impact Assessment

What ISO 42005 is

ISO/IEC 42005 sits in the ISO/IEC 42000 series alongside ISO 42001 (the certifiable management system) and ISO 23894 (risk guidance). Where ISO 23894 focuses on risk, ISO 42005 focuses on impact — a wider lens that includes benefits, second-order effects, and consequences for people who are not direct users of the system. It gives programs a repeatable AISIA process, a set of components to document, and criteria for deciding when to escalate.

When to conduct an AISIA

• Before an AI system is placed on the market or deployed for a new purpose.
• When the training data, model, or context of use changes materially.
• When a new stakeholder group becomes affected — for example, expanding to a new customer segment.
• After a significant incident, near-miss, or regulator inquiry.
• On a scheduled cadence (commonly annually) as part of the AIMS review cycle.

Key components of an AISIA

1. System description — what the AI system does, model type, inputs and outputs, decision autonomy.
2. Purpose and context of use — intended use, foreseeable misuse, deployment environment.
3. Stakeholders — direct users, affected non-users, operators, oversight bodies.
4. Expected benefits — for the organization, users, and affected groups.
5. Potential harms — safety, fairness and discrimination, privacy, autonomy, security, transparency, environmental impact.
6. Likelihood and severity — analysis for each identified impact.
7. Mitigations — controls, guardrails, human oversight, communication measures.
8. Residual impact — what remains after mitigations, and whether it is acceptable.
9. Decision and accountable owner — proceed, proceed with conditions, or do not proceed.
10. Review schedule — triggers and cadence for reassessment.

Categories of impact to consider

• Safety and physical harm
• Fairness, discrimination, and equal treatment
• Privacy and data protection
• Autonomy, dignity, and freedom of choice
• Transparency and explainability
• Security and adversarial resistance
• Environmental impact and energy use
• Economic effects, including labor and market impacts
• Societal and cultural effects

How an AISIA feeds ISO 42001

ISO 42001 Annex A includes explicit controls for assessing impacts of AI systems. An AISIA built with ISO 42005 is the artifact those controls expect. Its outputs — identified risks, mitigations, and residual impact decisions — flow directly into the ISO 42001 risk register and the operational planning clause (Clause 8), and its review schedule feeds performance evaluation (Clause 9).

How an AISIA feeds the EU AI Act

For providers of high-risk AI systems, the EU AI Act requires technical documentation covering intended purpose, foreseeable misuse, and expected impact on health, safety, and fundamental rights. For certain deployers, it requires a fundamental rights impact assessment. An ISO 42005 AISIA produces the raw material for both — a single assessment that satisfies both the ISO 42001 AIMS and the Act's documentation duties without duplication.

AISIA template outline

1. System identity — name, version, owner, inventory ID
2. Purpose and intended use
3. Foreseeable misuse and out-of-scope uses
4. Deployment context and environment
5. Data sources, quality, provenance, and lawful basis
6. Model type, capabilities, and autonomy level
7. Stakeholder map, including affected non-users
8. Expected benefits by stakeholder group
9. Potential harms by impact category, with likelihood and severity
10. Mitigations in place, mitigations required
11. Human oversight and override arrangements
12. Residual impact and acceptance decision
13. Accountable owner and sign-off
14. Reassessment triggers and next review date

Frequently asked questions