ISO 42001 Annex A.5.4: Assess AI Effects on Individuals and Groups
ISO 42001 control A.5.4 concerns assessing and documenting potential AI impacts on individuals and groups across the system lifecycle. The question extends beyond whether the tool performs well on average. It examines how people experience the decisions and actions influenced by the system, including people who are not its direct users.
What control A.5.4 requires in practice
Control A.5.4 asks the organisation to assess and record how its AI systems could affect individuals or groups of people, across the whole life cycle of the system. It narrows the general process in A.5.2 to the human level: what could happen to people who use the system or are affected by what it decides or recommends. Annex B, which is guidance, asks the organisation to consider its governance principles, policies and objectives, and the expectations of people who use the system or whose personal information it processes. It points to groups with specific protection needs, such as children, people with impairments, older people and workers, and lists areas that may be relevant: human rights, accessibility, financial consequences, safety and health, security and privacy, transparency and explainability, accountability and fairness. It also suggests consulting experts and users where needed.
Follow the pathway to a person
Annex B.5.4 connects the assessment with governance principles, policy, objectives and expectations of trustworthiness. It highlights different protection needs and potential effects such as accessibility, fairness, privacy and wellbeing. The guidance must be considered, with implementation tailored under B.1 rather than converted into identical conclusions for every use.
A practical approach follows an output into the action someone takes and then asks who may experience a benefit or disadvantage. Identify missing context and how a person can correct information or raise a concern. These questions help reveal effects that a technical metric alone may miss.
Why assessing effects on people matters
Average performance can hide poor outcomes for specific people. A system that works for most customers may be unusable for some, unfair to others or unclear to the people affected by its decisions. These effects tend to surface through complaints, regulatory attention or publicity, at which point correction is costly. Assessing effects on individuals and groups early lets the organisation adjust design, add human review or restrict use before harm occurs. It also supports commercial resilience: clients in sectors such as finance, health and employment are increasingly expected to demonstrate that AI-assisted services treat people appropriately. A documented assessment gives them, and the organisation's own leaders, something concrete to rely on.
How to implement control A.5.4
Follow the system's output to the person who experiences its effects, and ask what that person needs. The aim is to understand real experiences, not to produce a long list of abstract concerns, so keep the examination tied to this system and its actual users.
- Describe who uses the system, who is affected by its outputs and whose personal information it processes.
- Identify groups likely to need particular protection and the circumstances in which they meet the system.
- Walk through an output to the action someone takes on it, and ask who benefits and who could be disadvantaged.
- Review the areas Annex B suggests, such as fairness, transparency, privacy, accessibility and safety, and note which apply.
- Involve people with relevant knowledge, including users, domain experts or advocates where appropriate.
- Check how a person can obtain an explanation, correct information or raise a concern.
- Record findings and agreed treatments, and review them when the system, population or use changes.
Illustrative software example: access differs between users
A software service uses an AI assistant to guide customers through support options. Testing with experienced users suggests the flow is clear. Some customers using assistive technology cannot reach the explanation of how to obtain human help.
The impact assessment examines access to the decision route, not only answer accuracy. It obtains relevant user and accessibility expertise and considers a suitable response. The assessment should not assume that one successful user represents every group or that a technical adjustment alone resolves every concern.
Illustrative construction example: people are affected without using the tool
A construction company uses AI to analyse site images and compare subcontractor progress. Subcontractor workers never use the system, but its reports may influence how managers judge their work. Images do not capture all tasks or the reasons work was delayed.
The assessment considers how those missing conditions can affect people and groups, including reputation or work allocation. It examines the review and challenge arrangements around the report. This does not assume that every difference is unfair; it requires evidence and context before relying on the conclusion.
Consider different needs without stereotyping
Some groups may have particular protection or access needs in the relevant use. Obtain appropriate evidence and expertise rather than infer a person's needs solely from a category. The assessment should explain why a distinction matters to the system and its consequences.
Relevant contributors may include domain specialists, researchers or users. Participation can improve understanding, but one participant should not be treated as the voice of an entire population. Make the limits of consultation and available evidence visible.
Connect findings with a response
Document potential effects and bring them into risk assessment and treatment decisions. A result may justify changing the use, improving information, strengthening review or obtaining more evidence. These are options to evaluate, not universal solutions.
The assessment can identify benefits as well as adverse effects. Preserve their distribution: a benefit to one group does not automatically cancel a significant disadvantage to another. Management needs to understand the actual consequence rather than a single net score that hides it.
Evidence and common weaknesses
Useful evidence identifies affected people, the relevant decision path, context, uncertainty and response. Compare the documented intended use with actual practice. A system marketed as advisory may become decisive when employees routinely accept its output without meaningful review.
Common failures include studying only direct users, relying on aggregate accuracy to dismiss a group's experience and treating absence of complaints as proof of no adverse effect. The related external reporting control can help make effects visible after deployment.
Frequently asked questions
Do we assess people who never interact with the system?
Yes, where they may be affected by its outputs or the resulting decisions. Direct use is not the only route to impact.
Does a difference in results automatically prove unfairness?
No. Examine the evidence and context. A consequential difference warrants understanding rather than automatic dismissal or an unsupported conclusion.
Can one overall accuracy figure answer the impact question?
No. It may hide relevant differences or omit the way outputs influence people. Use evidence appropriate to the consequence.
Bring an overlooked affected-party perspective into assessment
Discuss an AI use with uncertain effects on people with Sterling. Scoped facilitation can connect assessment, documentation and Effivity ISO & GRC automation software. AI Risk & Impact Assessment develops relevant understanding. Return to the impact theme and the library.