Glossary · ISO and management systems
ISO/IEC 42005 asks who an AI system could affect, before it ships.
An ISO/IEC guidance standard on assessing the potential impacts of an AI system on individuals, groups and society, across the system's life cycle.
Back to the glossary01 · In plain words
In plain words
An ISO/IEC guidance standard on assessing the potential impacts of an AI system on individuals, groups and society, across the system's life cycle.
Risk assessment usually asks what could go wrong for the company. ISO/IEC 42005 turns the question outward: who could this AI system help or harm, and how badly? It gives guidance on running and recording an AI system impact assessment. It is guidance, not a set of requirements you get certified against.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
ISO/IEC 42001 expects an organization to assess the impacts of its AI systems but leaves the method open. ISO/IEC 42005 gives that method a shape, which makes assessments consistent across teams and easier for an auditor to follow. Buyers and regulators increasingly ask whether an AI feature was assessed for effects on people, for example on fairness, privacy or access to services. A documented impact assessment also forces product, data and legal teams to agree on intended use, misuse and safeguards before launch.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The impact assessment record
- Describes the system, its intended use, affected parties, potential impacts and the measures chosen.
- ISO/IEC 42001 audits
- Auditors look for impact assessments on the AI systems in scope and check that results fed into decisions.
- Product launch gates
- A sign-off step that requires a completed assessment for new or changed AI features.
- Customer and regulator enquiries
- Questions about how a system's effect on people was considered.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a lender's AI-assisted credit limit tool
A Jaipur NBFC plans to let a model suggest credit limits for first-time borrowers. Its impact assessment names who is affected: applicants with thin credit files, rural borrowers and staff who must explain decisions. It notes that the training data under-represents some districts and that a low limit could lock people out of credit. The team adds a human review for any reduced limit and a plain-language reason in the decision letter. The assessment is reopened when the model is retrained.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- AI risk assessment
- Focuses on risks to the organization and its objectives. The impact assessment focuses on effects on people and society.
- DPIA
- A data protection impact assessment under privacy law covers risks to individuals from personal data processing. An AI impact assessment can be wider, but the two are often run together.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Pick one AI system that affects people directly and assess it first.
- Name the affected groups explicitly, including those who never use the system.
- Tie each identified impact to a measure, an owner and a review trigger.
- Link the assessment to your AIMS so it is reopened when the system changes.
- GuideAI risk vs impact assessmentTwo assessments: inward risk and outward impact, and the register.
- GuideAI governance & the AIMSPrinciples, clauses 4–10, the operating model and the first five moves.
Sources: public ISO summaries of ISO/IEC 42005 (AI system impact assessment) and ISO/IEC 42001:2023.
Questions about ISO/IEC 42005
Can we be certified to ISO/IEC 42005?
No, it is guidance.
Certification applies to the management system standard, ISO/IEC 42001. ISO/IEC 42005 helps you carry out the impact assessments that the AIMS calls for.
Can we combine the AI impact assessment with a DPIA?
Often, if both sets of questions are answered.
Where an AI system processes personal data, one combined assessment can avoid duplicate work. Make sure the legal elements a DPIA requires are present, and ask counsel to confirm for your jurisdiction.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.