AI system impact assessment
Assessment of potential effects of an AI system on people and society.
How the laws define this
Both ISO/IEC 42001:2023 and ISO/IEC 42005:2025 agree on a common core function: an AI system impact assessment must evaluate how an AI system affects individuals, groups or groups of individuals, and society. The primary divergence between these two standards lies in their level of operational detail and scope across the system lifecycle. ISO/IEC 42001:2023 offers a high-level definition, framing the assessment strictly as a process to identify and evaluate potential impacts. In contrast, ISO/IEC 42005:2025 defines a more extensive, guidance-oriented, and repeatable framework that spans the complete AI lifecycle, encompassing design, development, deployment, and post-deployment monitoring. Furthermore, ISO/IEC 42005:2025 explicitly requires analyzing foreseeable uses and producing auditable records of identified benefits, harms, mitigations, and monitoring plans, while distinguishing the assessment from, yet aligning it with, other assessments such as risk assessments and DPIAs.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| ISO | ISO/IEC 42001:2023 - Information technology — Artificial intelligence — Management system | In Force | This definition limits the assessment to a process focused solely on identifying and evaluating potential impacts, without specifying a framework, documentation, or lifecycle stages. |
| ISO | ISO/IEC 42005:2025 - Information technology — Artificial intelligence — AI system impact assessment | In Force | This definition adds a guidance-oriented, repeatable framework that analyses, documents impacts across the full AI lifecycle, distinguishes from other assessments, and produces auditable records of benefits, harms, mitigations, and monitoring. |
What it triggers
- ISO/IEC 42001:2023 describes a process for organizations developing or deploying AI to identify and evaluate potential impacts on individuals, groups, and society.source
- ISO/IEC 42005:2025 sets out a framework for organizations developing or deploying AI systems to systematically assess and manage impacts on safety, privacy, and fundamental rights.source
Definitions (2)
A process to identify and evaluate the potential impacts of an AI system on individuals, groups of individuals, and society.
AIIA is a guidance-oriented, repeatable framework to identify, analyse and document how an AI system and its foreseeable uses may affect individuals, groups and society throughout the AI lifecycle (design, development, deployment and post-deployment monitoring). It is distinct from, but aligned with, other assessments (e.g., risk assessments, DPIAs) and is intended to produce auditable records of identified benefits, harms, mitigations and monitoring plans.
Not to be confused with
AI risk assessment focuses on identifying, analysing and evaluating AI-related risks, while this term targets broader impacts on individuals, groups and society.
AI impact assessment is a documented analysis of risks and harms before deployment, whereas this term provides a repeatable framework covering the full AI lifecycle with auditable records.
Questions and answers
What is distinctive about the ISO/IEC 42001 definition of AI system impact assessment?
It frames the assessment as a process to identify and evaluate impacts on individuals, groups, and society as part of AI management systems described in ISO/IEC 42001:2023.
How does ISO/IEC 42005 define AI system impact assessment?
It is a guidance-oriented framework to identify, analyse and document AI system effects on individuals, groups and society across the full lifecycle. It produces auditable records and aligns with but differs from risk assessments or DPIAs.
Do these definitions impose legal duties for AI impact assessments?
No, both are from voluntary, non-binding ISO standards. ISO/IEC 42001:2023 describes AI management systems, and ISO/IEC 42005:2025 provides guidance.
Related Terms
AI risk assessment
Process to identify, analyse and evaluate AI-related risks....
AI Impact Assessment (AIA)
Pre‑deployment assessment of risks and mitigation measures....
AI system impact assessment (AIIA)
A repeatable assessment of an AI system's impacts across its lifecycle....
Evaluation of Impact
Human-rights-focused impact assessment (DPIA-like) for AI projects....
AI Impact Assessment
Documented risk and harms analysis before AI deployment....