ISO 42001 Annex A.5.3: Keep AI Impact Assessment Results Understandable
ISO 42001 control A.5.3 concerns documenting AI system impact-assessment results and retaining them for a defined period. A useful record explains the assessment rather than merely declaring that it was completed. It should enable later decisions when the system, purpose or affected population changes.
What control A.5.3 requires in practice
Control A.5.3 asks the organisation to document the results of its AI system impact assessments and to retain them for a defined period. Two outputs follow: a record of what the assessment concluded, and a decision, made by the organisation, on how long such records are kept. Annex B, which is guidance, says the records may help decide what to tell users and other interested parties, and that they should be retained and updated in line with the assessment elements described for A.5.2. Retention can follow the organisation's own schedule or be informed by legal and other requirements. Annex B also suggests topics that records may cover: intended use and reasonably foreseeable misuse, positive and negative effects, predictable failures and mitigations, the groups the system applies to, system complexity, the role of people in oversight and effects on employment and skills. The organisation judges which are relevant.
Preserve the meaning of the result
Annex B.5.3 considers intended use, foreseeable misuse, positive and negative effects, failures, relevant populations and the role of people in oversight. It also connects records with communication and retention needs. The guidance must be considered under clause 6.1.3(e), but its examples are not a universal report template.
As an original evidence test, give the record to a competent colleague who did not attend the assessment. Can they identify what was examined, which consequences mattered, what remained uncertain and what decision followed? If they need the original author to explain every conclusion, the record may be too thin.
Why keeping impact assessment records matters
An assessment that cannot be understood later has little value. Staff change, systems evolve and the original reasoning fades, yet the organisation may be asked years afterwards why a system was deployed and what was known at the time. A clear record protects the organisation by showing that effects were considered and decisions were reasoned. It also prevents accidental reuse of a conclusion beyond the setting it covered. Records that explain scope, uncertainty and decisions help communication with users and partners, because the organisation can say plainly what the system is intended for and where it should not be used. A defined retention approach avoids both premature disposal and indefinite hoarding.
How to implement control A.5.3
Treat the record as a message to a future reader who was not in the room. Retention and readability are the two tests, so involve whoever keeps records generally, and make sure access is controlled where assessments contain sensitive information.
- Decide the minimum content of a record, drawing on the topics Annex B suggests and adding your own where needed.
- Record the scope boundary: which system, purpose, population and conditions the conclusion covers.
- State the effects considered, what was judged uncertain and what decision followed.
- Link the record to the system version and to any conditions set for release or monitoring.
- Set a retention approach based on your schedule and applicable legal requirements, and write it where record keepers can find it.
- Test readability by asking a competent colleague outside the project to explain the conclusion from the record alone.
- Update the record when the use, population or system changes, keeping earlier versions identifiable.
Illustrative BPO example: a conclusion loses its boundary
A BPO provider documents that AI-generated summaries present a manageable impact for a defined routine service with employee review. Months later, another team sees only the conclusion and applies it to advice about disputed customer entitlements.
The record needs to preserve the assessed purpose, context and oversight assumptions. A clear boundary helps later users recognise that the conclusion does not cover every use of the same tool. The organisation links new assessments to the earlier record without rewriting history.
Illustrative manufacturing example: population differences disappear
A manufacturer assesses AI-supported workforce planning at one plant. The report notes that local managers consider employee constraints before assigning work. During group consolidation, the report is shortened to a general statement that the tool has no significant impacts.
The shortened version loses the operating conditions and relevant local context. A useful summary should preserve material qualifications and point to supporting evidence. Simplifying presentation is reasonable; removing the basis of the conclusion makes later decisions unreliable.
Define retention and manage updates
The control specifies a defined retention period, not a fixed ISO number of years. Consider organisational schedules and applicable obligations, while preserving the management-system requirements to retain assessment results. Different information within the assessment may need different protection.
Updates should make changed assumptions and conclusions understandable. Do not overwrite an earlier assessment so that the record appears to describe conditions that did not exist at the time. Link the current conclusion with the relevant system and use.
Use results to inform communication
Assessment documentation can help determine what users or other interested parties need to know. A consequential limitation may need to appear in an instruction or customer explanation. The full internal report may contain sensitive information that should not be distributed without a suitable purpose.
Distinguish useful communication from unrestricted publication. The control does not require every assessment to be public. Coordinate the decision with user information, relevant obligations and the organisation's information controls.
Evidence and common mistakes
Look for a documented result, a defined retention arrangement and links to the decision and relevant evidence. The record should reflect the assessment process and feed risk assessment. A completed checklist with unexplained answers may not convey the reasoning.
Common weaknesses include retaining only a final score, omitting foreseeable misuse, losing the assumptions behind human oversight and treating a supplier report as though it examined the organisation's own use. Record unknowns accurately rather than fill gaps with generic assurances.
Frequently asked questions
How long must impact-assessment results be kept?
A defined period is required by this control, but no universal duration is stated. Determine the period using relevant requirements and evidence needs.
Can we publish a short summary instead of the full report?
A suitable summary can support communication, but preserve material qualifications and retain the required assessment evidence internally.
Should an updated assessment replace the old result?
Do not lose the history needed to understand earlier decisions or the requirement to retain all assessment results. Use controlled versions and clear relationships.
Make an impact conclusion traceable and usable
Ask Sterling to review the evidence behind an AI impact conclusion. Scoped support can connect documentation, retention and Effivity ISO & GRC automation software. AI Risk & Impact Assessment helps teams develop meaningful assessment records. See the impact controls and the full library.