ISO 42005: how to carry out an AI impact assessment and link it to ISO 42001

ISO/IEC 42005 is the international guidance for AI system impact assessments, published in May 2025 (first edition, 28 May). ISO 42001 asks you to assess the consequences of an AI system but says little about how. ISO 42005 describes that process: what you record, when you do it and who should be involved.

What an AI impact assessment is

An AI impact assessment describes how an AI system, and its reasonably foreseeable use, may affect individuals, groups and society. A classic risk analysis looks at what can happen to the organisation. The impact assessment looks outward: who experiences the consequences of this system, and what are they?

A data breach primarily affects the organisation. A system that wrongly rejects applicants affects people who never become customers or employees and who often cannot trace the decision. The assessment is meant to make such effects visible before the system goes live.

Guidance, not a certifiable standard

ISO 42005 is guidance: it contains recommendations ("should"), not requirements ("shall"). No certificate is issued against it, and an auditor does not test you against its text. That does not make the impact assessment optional, because ISO 42001 sets the requirement. In a certification audit the auditor checks whether you have an assessment process, whether it has been applied to your AI systems and whether the outcomes show up in your risk treatment.

The link with ISO 42001

ISO 42001 has two clauses that meet here. Clause 6.1.4 asks, at the planning stage, for a process to assess the consequences of AI systems for individuals and groups. Clause 8.4 asks for those assessments to be carried out across the life cycle of the system. ISO 42005 is a usable method for both, and its Annex A maps the requirements and recommendations of ISO 42001 to the process steps of 42005. You do not need to build a second process next to your management system. How the clauses play out in a certification project is covered in ISO 42001 explained.

What belongs in an assessment

Following the structure of ISO 42005, an assessment records, among other things: the description of the system, its functions and its intended and unintended use; the data and algorithms used and the environment it runs in; the affected stakeholders and other interested parties; the positive and negative consequences, for example for fairness, privacy, safety and transparency; the magnitude and likelihood of each consequence; and the measures, limitations and uncertainties.

The standard has five annexes. Besides the mapping to ISO 42001 (Annex A) and to ISO/IEC 23894 for risk management (Annex B), it contains a taxonomy of harms and benefits, guidance on aligning the assessment with other assessments such as privacy and human rights, and an example template. The template is a starting point. An organisation with one chatbot needs less of it than an organisation with dozens of AI systems in different risk classes.

When to carry out an assessment

Before a system goes into production, and again after significant changes: a different intended use, different users, new or changed data, a retrained model or a changed legal context. Because not every system needs a full assessment, a short triage helps: which systems affect people in a way that matters, and which do not? If you do not yet know your AI systems, start with an inventory, including what staff use on their own (see taking inventory of shadow AI).

Impact assessment, DPIA and the AI Act

A DPIA under the GDPR is about the privacy risks of processing personal data. An AI impact assessment is broader: bias, reliability, transparency and societal effects that need not involve personal data at all. If an AI system processes personal data for a decision that affects people, it often falls under both, and you can bring the outcomes together in one well-founded assessment. Annex D of ISO 42005 deals with aligning with other assessments.

The AI Act also has its own fundamental rights impact assessment in Article 27. It applies to certain deployers of high-risk AI systems, such as public-law bodies and organisations providing public services. The deadlines for high-risk systems have shifted through the Digital Omnibus, see the current deadlines. ISO 42005 is not a harmonised standard and does not replace the Article 27 assessment, but an assessment recorded along these lines supplies part of the material. Which role you have and which category your system falls into is covered in the risk classification under the AI Act.

What an auditor wants to see

In an ISO 42001 audit the auditor does not ask for a nice template but for evidence that the process works. Think of a list of AI systems with the triage outcome per system, a completed assessment for the systems that call for one, and a reassessment after a change. The auditor follows one system from start to finish: from the description and the stakeholders through the identified consequences to the measure and the decision. If a link is missing, that is usually where the finding arises.

Practical points

An assessment filled in afterwards to complete a file mainly shows that the process does not work. Record who assessed the system, which stakeholders were considered and who approved the outcome. Let the measures flow into your risk treatment and your Statement of Applicability. And keep the assessment current: a document from the design phase that was never revisited says little about a model that has been retrained since.

More on our approach to ISO 42001 is on our compliance page.