ISO 42001 Annex A.5.2: Build a Usable AI Impact Assessment Process

What control A.5.2 requires in practice

Control A.5.2 asks the organisation to establish a process for assessing the potential consequences of an AI system for individuals, groups of individuals and societies, across the system's life cycle. The word process matters: a single assessment for one release does not meet the intent if nothing governs the next system or the next change. Annex B, as guidance, suggests what the process may address: when an assessment is performed, for example according to how critical the purpose is, how complex or automated the technology is and how sensitive the data is; what elements the assessment contains, from identifying sources and events through analysis, evaluation and treatment to reporting; who carries it out; how results feed design or use and trigger reviews; and which individuals and societies may be affected. It also invites the organisation to check whether existing privacy or safety assessments cover AI aspects adequately.

Design the process around a decision

Annex B.5.2 considers intended purpose, context, automation, technology complexity and data sensitivity when shaping assessment arrangements. It also addresses contributors, assessment activities and how findings inform design or use. The guidance is normative and must be considered, while B.1 allows the organisation to tailor its implementation.

Begin by identifying the decision that needs an impact perspective. A proposed deployment, a material extension or an operational review may require different depth. Explain who contributes relevant knowledge and how the results reach the people choosing treatment or operating conditions.

Why an AI impact assessment process matters

Decisions about AI are often made quickly, by teams focused on capability and delivery. A defined assessment process gives them a point at which someone asks who could be affected and how, and gives management a record of what was considered. This reduces the chance of expensive late redesign, complaints and loss of client confidence. It also saves effort over time, because a clear trigger and method prevent every new use case from being argued from scratch. Where organisations already run privacy or safety assessments, a joined-up process avoids duplicated questionnaires and conflicting conclusions. For buyers and regulators, a working process is far more persuasive than a single polished assessment of a flagship system.

How to implement control A.5.2

Design the process around the decisions it must inform, and keep it light enough to be used. The process should scale with the system, so a light assessment can cover routine uses while deeper work is reserved for higher-stake or novel ones.

1. Identify the decisions that need an impact view, such as approving a new system, a material extension or a change of use.
2. Define triggers, using factors such as criticality, level of automation and sensitivity of data.
3. Set out the steps: identify possible effects, analyse likelihood and consequence, evaluate, decide treatment and record the outcome.
4. Say who performs the assessment and which expertise, including affected-user or domain knowledge, must contribute.
5. Define how results reach those choosing treatment, and what can pause or condition a release.
6. Check existing privacy, safety and security assessments, and decide how they connect to this process.
7. Run it on a real system, then adjust questions that produced little value.

Illustrative software example: recommendations become automatic

Illustrative construction example: context changes the interpretation

A construction group uses image analysis to describe project progress. On a new site, images capture only part of the work and miss activities performed indoors. Management proposes using the reports in discussions about subcontractor performance.

The assessment process identifies who understands the missing context and who could be affected by the resulting interpretation. It examines intended use and foreseeable misuse, including reports circulated without qualifications. A technical image-recognition score alone cannot answer those questions.

Make the assessment activities coherent

A useful process identifies potential effects, analyses their significance, evaluates what needs attention and connects the result with appropriate responses. Documentation and communication preserve the decision basis. The organisation can integrate these activities with risk management while retaining the specific perspective on people and society.

Do not treat a workshop as complete merely because participants discussed ethical topics. The output should explain the relevant use, affected parties, consequence pathways and unresolved questions. It should also identify how the findings influence the decision being made.

Coordinate specialist assessments

Privacy, security, safety or other specialist work may address important parts of the impact picture. Annex B encourages examining whether such assessments adequately incorporate AI considerations. Reuse relevant evidence, but check the boundary rather than assume one specialist report covers every consequence.

For the construction example, information-governance review may address image handling but not whether performance conclusions are misleading. Different expertise can contribute to a connected assessment without creating duplicate reports for their own sake.

Evidence and practical tests

Common nonconformities with A.5.2

Findings usually concern a process that exists on paper but does not govern real decisions.

• An assessment was completed for one flagship system but there is no defined process or trigger for other systems or changes.
• The assessment considers risks to the organisation only, with no examination of effects on users or affected groups.
• Results are filed but do not visibly influence design, release conditions or monitoring.
• People who understand the affected users or the domain were not involved, so important effects were missed.
• A material change to the system's purpose or automation level was made without any reassessment.