Short answer
ISO/IEC 42001 requires an AI system impact assessment that considers potential consequences of an AI system for individuals, groups and society, not only risks to the organisation. ISO/IEC 42005:2025 gives guidance on how to do it. A practical assessment lists affected stakeholders, possible impacts, their likelihood and severity, and the controls that reduce them.
Key takeaways
- Impact assessment looks outward at people and society; risk assessment looks at the organisation.
- ISO/IEC 42005:2025 is guidance for doing it, not a certifiable standard.
- Assess at design, before deployment and whenever the system or its use changes.
- Hiring tools are high-risk under the EU AI Act, so this example matters beyond ISO 42001.
Impact assessment vs risk assessment
An ISO 42001 AI management system has two assessments that are easy to confuse. The AI risk assessment asks what could go wrong for the organisation. The AI system impact assessment asks what the system could do to the people it affects, such as applicants, customers or the public. Auditors look for both, and for the link between them.
The example system
A SaaS HR platform offers a model that ranks job applicants' CVs against a role description. Recruiters see the ranked list; the model does not reject anyone automatically. Under the EU AI Act, AI used for recruitment is an Annex III high-risk use case.
The assessment
| Stakeholder | Potential impact | Likelihood | Severity | Controls |
|---|---|---|---|---|
| Applicants | Qualified people ranked low because of proxies for protected characteristics | Medium | High | Bias testing per release; excluded features; human review of the full list |
| Applicants | No way to understand or challenge a ranking | High | Medium | Plain-language notice; contact route for questions |
| Recruiters | Over-reliance on the ranking | High | Medium | Interface shows reasons, not just scores; training |
| Employer customers | Discrimination claims from biased shortlists | Low | High | Customer documentation of limits; audit logs |
| Society | Entrenching historical hiring patterns | Medium | Medium | Training data review; periodic outcome monitoring |
Turning it into evidence
Checklist
Impact assessment evidence
0 of 6 done
Keep it alive
The assessment is not a one-off document. Retraining the model, adding a new data source or selling into a new country can all change the impacts. Tie a reassessment trigger to your change management so it happens without anyone having to remember.
Frequently asked questions
Is an AI system impact assessment required by ISO 42001?
Yes. ISO/IEC 42001 requires organisations to assess the potential consequences of AI systems for individuals, groups and society. ISO/IEC 42005:2025 provides guidance on carrying it out.
Is ISO/IEC 42005 certifiable?
No. ISO/IEC 42005:2025 is a guidance standard. Certification is against ISO/IEC 42001.