AI System Impact Assessment Under ISO/IEC 42001
How to assess the impacts of AI systems on people and society within an ISO/IEC 42001 AI management system
Key takeaways
- ISO/IEC 42001:2023 is the management system standard for organisations that develop, provide or use AI systems.
- Besides AI risk assessment and treatment, it requires an AI system impact assessment that looks at potential consequences for individuals, groups and society.
- Impact assessment and risk assessment are related but different: risk focuses on the organisation’s objectives; impact focuses on those affected by the AI system.
- ISO/IEC 42005 gives guidance on AI system impact assessments, and ISO/IEC 23894 on AI risk management.
- Results feed the selection of controls from Annex A and the Statement of Applicability.
1. Why impact assessment matters
An AI system can meet its technical performance targets and still cause harm: unfair outcomes for a group of applicants, misleading information to customers, privacy intrusion, or decisions people cannot challenge. These harms may not appear in a traditional risk register focused on the organisation. ISO/IEC 42001 therefore asks organisations to assess the impacts on people and society as part of planning.
2. Where it sits in ISO/IEC 42001
| Element | Purpose |
|---|---|
| Context and AI policy | Define the organisation’s role (developer, provider, user) and commitments |
| AI risk assessment and treatment | Identify and treat risks to achieving AI objectives, including risks to others |
| AI system impact assessment | Assess potential consequences for individuals, groups and societies across the system’s life cycle |
| Annex A controls | Reference controls on policies, internal organisation, resources, impact assessment, life cycle, data, information for interested parties, use and third parties |
| Statement of Applicability | Justify which controls are included or excluded |
3. What to assess
| Dimension | Example questions |
|---|---|
| Purpose and context | What decisions does the system support or make? Who is affected? |
| Fairness | Could outcomes differ unjustifiably between groups? |
| Transparency and explainability | Can affected people understand and challenge outputs? |
| Privacy and data | What personal data is used? Is it lawful and minimised? |
| Safety and security | Could errors or misuse cause physical, financial or psychological harm? |
| Human oversight | Who can intervene, override or stop the system? |
| Reliability | How does performance change with new data or conditions? |
| Societal and environmental effects | Wider effects on employment, access to services, energy use |
4. A practical assessment process
- Describe the system: purpose, users, data, model type, deployment, decision role.
- Identify affected parties: direct users, subjects of decisions, third parties, vulnerable groups.
- Identify potential impacts: positive and negative, intended and unintended, including misuse.
- Evaluate severity and likelihood, considering reversibility and scale.
- Define measures: design changes, data controls, testing, human oversight, information to users, monitoring.
- Document and approve: decision to deploy, conditions, residual impacts accepted by an accountable person.
- Monitor and review: after deployment, after significant changes, and at planned intervals.
5. Linking to the life cycle
| Life-cycle stage | Assessment focus |
|---|---|
| Design | Intended use, affected groups, data sources |
| Development | Data quality, bias testing, performance metrics |
| Verification and validation | Testing against impact-related criteria |
| Deployment | User information, oversight arrangements |
| Operation and monitoring | Drift, complaints, incidents, misuse |
| Retirement | Data handling, transition for affected users |
6. Common weaknesses
- Treating impact assessment as a one-off form completed before launch.
- Considering only technical accuracy, not effects on people.
- No involvement of people who understand the affected groups.
- No mechanism for affected people to raise concerns or contest outcomes.
- Assessment not updated after model retraining or new uses.
Conclusion
AI system impact assessment is what makes an AI management system responsible as well as efficient. By asking who could be affected and how, and by linking the answers to controls, oversight and monitoring, organisations can use AI with confidence and show customers and regulators that they take its effects seriously.
List the AI systems your organisation uses today. For each one, can you name the people affected by its outputs?