ISO 42001 · the AI system impact assessment
The AI system impact assessment, written in the order of Clause 6.1.4
The impact assessment is the record ISO 42001 has and ISO 27001 does not: what one AI system could do to the people it touches and to society, judged before it runs and again when it changes, so this page writes it for one system: the purpose and the foreseeable misuse, the people, the consequences at the three levels the standard names with a likelihood and a severity each, the benefits, the measures, the result and the review.
The consequences, at the three levels the standard names
For each level, how likely the harm is and how severe it would be, then what it is; the highest of the six ratings sets the line the result is read against.
To individuals
A person wrongly classified, delayed, refused, misinformed, or treated on a wrong draft; their data, their safety, their rights, their money.
To groups of people
Effects that appear only across a group: a language, a region, an age, a disability, a customer segment, treated worse on average.
To society
Consequences beyond the users and the company: the environment, public discourse, employment, trust in a service people depend on.
The assessment
Every part the clause asks for, in its order; an empty entry is written as a gap to fill, not skipped.
# AI system impact assessment: [AI system], [company] Role: We use it. Status: Planned. Owner: [to be completed]. Assessed on [to be completed]. This assessment follows Clause 6.1.4 of ISO/IEC 42001:2023 for one AI system: its intended purpose and reasonably foreseeable misuse, the people it touches, the consequences to individuals, to groups and to society with a likelihood and a severity each, the benefits, the measures that limit the harm, the result and the review. It is kept as documented information and acted on through the system's life cycle. Written on . ## 1. Intended purpose and foreseeable misuse [to be completed] Reasonably foreseeable misuse: [to be completed] ## 2. The people the system touches [to be completed] ## 3. The consequences Each level rated for likelihood and severity before the measures below, so that the measures can be read against what they address. ### To individuals Likelihood: Low. Severity: Low. [to be completed] ### To groups of people Likelihood: Low. Severity: Low. [to be completed] ### To society Likelihood: Low. Severity: Low. [to be completed] ## 4. The benefits [to be completed] ## 5. The measures [to be completed] Human oversight: [to be completed] ## 6. Result and review Result: the impacts are acceptable once the measures above are in place; the highest rating given above is Low. The measures are tracked as actions with an owner and a date, and the system proceeds only with them. AI Act: the reading of this system under the Regulation is not yet recorded. [Read the system against the high-risk list and the transparency duties and record the result here.] Review by [to be completed], and earlier when the purpose, the data, the users or the outputs change, when an incident touches the system, or when a complaint shows a consequence this assessment did not foresee. This assessment is retained as documented information of the AI management system, versioned, and available to the certification body and, on request, to the people the system touches. This assessment is written from the entries given. It is not certification or legal advice; the certification body reads the assessment for the people considered, the consequences judged and the measures taken, and the AI Act reading recorded here is the company's own, to be checked against the Regulation.
In StandardOS every AI system carries its assessment
Each AI system in the inventory has an impact assessment with the affected groups, the purpose, the foreseeable misuse and the consequences as fields, the review date on the calendar, the measures as actions, the AI Act reading beside it, and the Annex A controls on impact assessment evidenced by the record itself.
The clause read as a record, level by levelThe Article 27 fundamental rights impact assessmentIs the system high-risk under the AI Act?Write the AI policyThe ISO 42001 controls list