Effects on people and society

The controls about consequences to people and to society, as distinct from consequences to the organization. This is the group with no ISO 27001 counterpart, and the reason a 42001 risk assessment asks questions a security one does not.

• A.5.2A defined process for assessing what an AI system does to people
• A.5.3Keeping the result of each impact assessment
• A.5.4Assessing harm to individuals and to groups of people
• A.5.5Assessing harm beyond the people who use the system

Every control here needs an applicability decision and a justification in your Statement of Applicability, including the ones you exclude. See which clauses StandardOS covers.