ISO 42001 AI Impact Controls: Individuals, Groups and Society
ISO 42001 Annex A.5 helps organisations assess what their AI systems can mean for people and society. It connects an assessment process, documented results and explicit consideration of effects on individuals, groups and society. The purpose is not to produce a long list of abstract ethical concerns. It is to understand consequences in the intended context and use that understanding when deciding how a system should be developed, deployed or used.
Define the actual decision and affected context
Start with the system, its purpose, how it will be used and who may experience the effects. “We use AI in customer service” is too broad to support a meaningful assessment. A more useful description identifies the task, degree of automation, information used, decisions influenced, users and people affected by those decisions. It should also recognise foreseeable misuse and the surrounding technical, social and jurisdictional context.
Distinguish effects on the organisation from effects on others. An inaccurate recommendation may create rework for the business while also causing delay, exclusion or distress for a person. Those consequences can differ in severity and distribution. Assessing only reputational or financial loss to the organisation may overlook the reason the impact matters in the first place.
Annex B discusses a process proportionate to factors such as context, criticality, complexity, automation and data sensitivity. Its guidance must be considered, while B.1 allows tailored implementation. The guidance does not prescribe a single scoring scale or demand an identical workshop for every system. Choose methods that help the organisation identify, evaluate, address and communicate relevant impacts.
Illustrative manufacturing example: workforce and wider effects
A manufacturer introduces AI-assisted production planning. The immediate business case focuses on material use and throughput. An impact assessment also considers how recommendations may affect work allocation, the ability of supervisors to question outputs and the visibility of local operating constraints. Workers may experience consequences even though they never directly interact with the AI interface.
The assessment team examines the intended decision support, the people affected and foreseeable use outside the evaluated conditions. It distinguishes the AI recommendation from the authorised operational decision. Where uncertainty concerns working conditions or specialist safety matters, the appropriate competent functions contribute; the assessment does not invent its own technical safety rules.
For societal effects, the manufacturer considers issues plausibly connected with this system and scale of use, such as resource consumption or broader changes arising from deployment. It records why some effects are relevant and others are outside the justified assessment scope. A local planning application does not automatically require an unsupported claim about every global consequence of AI.
Document the reasoning that supports action
A.5.3 focuses attention on results and their retention. A useful assessment record explains the system and context, affected parties, significant findings, uncertainties, response decisions and links to follow-up work. Annex B discusses defined retention arrangements, but ISO 42001 does not establish one universal number of years for all impact records. Determine appropriate retention using the relevant obligations and organisational needs.
Maintain a connection between the assessment and the system version or use it describes. Otherwise, a detailed report can be applied to a changed service for which its assumptions no longer hold. Link significant changes to reassessment arrangements, and use the operational requirements of clause 8.4 to keep assessment from becoming a one-time project exercise.
Sharing results requires judgement. Users, customers, governance functions or other interested parties may need relevant information, but that does not mean every complete assessment must be published. Consider appropriate recipients, confidentiality, accuracy and applicable obligations. A summary should not conceal material limitations that the recipient needs for a decision.
Use impact findings in risk treatment and improvement
Assessment only creates value when its findings influence action. Connect them to risk assessment, controls, system requirements, evaluation criteria, communication and operational decisions. If a team identifies a serious concern but the release process cannot receive or act on it, the weakness is in governance as well as analysis.
Follow a significant finding to closure or a justified continuing decision. Check whether the response was implemented and whether its intended effect was evaluated. A chosen control may introduce a new burden or shift the impact to another group. That possibility is a reason to examine results, not to assume that all mitigation is ineffective.
Common weaknesses include using generic impact lists without context, considering only direct users, excluding foreseeable misuse, presenting assumptions as established facts and retaining a report without its decision history. Another is treating a supplier's assessment as automatically sufficient for a customer's different use. External evidence can help, but its relevance and limitations need examination.
Questions for a useful assessment review
Ask whether the record identifies the people affected, explains how evidence supports the findings and shows what changed because of the assessment. Select one uncertainty and one significant impact, then trace their handling. This is a suggested readiness check rather than a prescribed audit script. It helps expose a process that produces documentation without influencing the system.
Explore information for interested parties for the communication connection and AI life-cycle controls for the implementation connection. The Annex A hub explains how risk-selected controls support the wider management system without making certification an approval of individual AI outcomes.
Make impact assessment useful to a real decision
Scope an AI impact assessment review with Sterling around one system, affected population and pending decision. Discuss facilitation, documentation, follow-up and an appropriate role for Effivity ISO & GRC automation software. Enrol in AI Risk & Impact Assessment to strengthen the team's understanding before applying the process to its own evidence and responsibilities.
Individual controls in this theme
A.5.2 · Build a Usable AI Impact Assessment Process
Build an impact-assessment process that identifies who may be affected and turns findings into design or use decisions. Software and construction examples examine changing automation and operating context. Learn how Annex B informs triggers, contributors, assessment activities and links to specialist work without prescribing one universal form.
A.5.3 · Keep AI Impact Assessment Results Understandable
Document impact-assessment results so a later reader can understand the purpose, affected parties and reasoning behind decisions. BPO and manufacturing examples show how lost context weakens reassessment. Learn to define retention, preserve relevant versions and use results for communication while protecting sensitive information and avoiding unsupported disclosure claims.
A.5.4 · Assess AI Effects on Individuals and Groups
Examine how an AI system can affect individuals and groups throughout its lifecycle, including people who never use the interface. Software and construction examples explore overlooked context and accessibility. Learn to consider different protection needs, obtain relevant expertise and distinguish a high overall performance score from evidence about consequential effects.
A.5.5 · Examine Wider Societal Impacts of AI
Look beyond immediate users and organisational gains to potential societal effects of an AI system. Manufacturing and software examples examine wider resource and information consequences. Learn to assess positive and negative pathways proportionately, recognise misuse and historical patterns, and document uncertainty without claiming a small organisation must solve every societal problem.
Why assessing AI impact on people matters
Most reputational and legal damage from AI does not come from a system failing to run. It comes from a system running as designed and affecting people in ways nobody examined: a customer wrongly refused, a group poorly served, a decision that cannot be explained. Impact assessment is the discipline of looking for those effects before they are reported by others. Done well, it gives management evidence for decisions such as whether to proceed, add human review or narrow the use. It also strengthens commercial conversations, because clients and public bodies increasingly ask how an AI service has been examined for effects on individuals and society. For an auditor, this theme shows whether the organisation can turn concern for people into a working process with recorded outcomes rather than a statement of values.
Frequently asked questions
Is AI impact assessment the same as organisational risk assessment?
They are related but not interchangeable. Impact assessment examines consequences for individuals, groups and society in the relevant context. Its findings inform risk assessment and treatment, which also consider the organisation's criteria and objectives.
Does every system require the same level of impact analysis?
No single level of detail suits every context. Use a process that reflects the system, intended use, possible consequences and relevant uncertainty. Proportionality should be reasoned; it is not a reason to skip plausible significant effects.
Does a completed assessment demonstrate legal compliance?
No. It can support informed governance and relevant compliance work, but it does not establish legal clearance or replace applicable specialist assessment. Obligations depend on the actual activities and jurisdictions involved.
Illustrative BPO example: prioritisation and uneven access
A BPO organisation uses AI to prioritise incoming service requests for a client. Average response times improve in a pilot. A closer assessment asks who benefits and who might wait longer. Requests written briefly, in unusual language patterns or with incomplete background may be harder for the system to interpret. The relevant impact is not merely a lower model score; it is the consequence of delayed attention for the person seeking help.
The team defines the use boundary, reviews representative cases and involves people who understand service consequences. It examines whether the operating process offers an appropriate route to identify urgent cases and correct misprioritisation. It also considers how staff may over-rely on the ranking under workload pressure. These are original assessment choices, not a claim that one particular technical intervention is mandated by ISO 42001.
The documented result distinguishes demonstrated findings from open questions. The decision may limit the initial use, require further evaluation or change the operating process. Later monitoring checks whether the expected effects hold in service. A positive average result does not erase an unresolved adverse pattern affecting a particular group.