ISO 42001 AI Risk Assessment: Make Consequences Visible
ISO 42001 clause 6.1.2 establishes the AI risk assessment process, while clause 8.2 requires that process to be used at planned intervals and when significant changes are proposed or occur. Together, they connect a repeatable method with continuing decisions. The assessment considers consequences for the organisation, individuals and societies, not only financial exposure for the AI owner.
What clause 6.1.2 requires in practice
Clause 6.1.2 requires the organisation to set up a risk assessment process for AI, built to meet several stated qualities. It draws on, and stays in line with, the AI policy and AI objectives. It is designed so that repeated assessments give consistent, valid and comparable results. It identifies risks that help or hinder the achievement of AI objectives.
The process includes analysis and evaluation. Analysis weighs the possible consequences for the organisation, individuals and societies should identified risks materialise, estimates how likely that realistically is where applicable and sets the level of each risk. Evaluation compares results with the criteria from clause 6.1.1 and prioritises risks for treatment. A note says that an AI system impact assessment under clause 6.1.4 can be used when assessing consequences. Documented information about the process must be retained, and clause 8.2 requires assessments to be performed at planned intervals and when significant changes are proposed or occur, with results kept. The standard does not prescribe a scoring matrix.
Align assessment with AI policy and objectives
The assessment process is informed by and aligned with AI policy and objectives. It identifies risks that can help or hinder those objectives and is designed to produce consistent, valid and comparable repeated results. Retain documented information about the process.
Start by explaining what the AI use is meant to achieve and what decision the assessment needs to support. An assessment for a limited internal trial is not necessarily sufficient for a service offered to customers. The objectives and conditions may change even when the underlying technology stays the same.
Use criteria that support judgement
Analysis considers potential consequences, realistic likelihood where applicable and risk levels. Evaluation compares those results with the established criteria and prioritises treatment. The criteria come from the planning arrangements under clause 6.1.1 and should make acceptance decisions understandable.
No universal numerical matrix is prescribed. Avoid scores that appear precise while concealing uncertainty about who may be affected or how the system behaves. Describe assumptions and evidence limitations so the decision-maker can see where further work is needed. Repeated assessments should be comparable because their meaning is clear, not merely because they use the same colours.
Why a repeatable AI risk assessment matters
A risk assessment is only useful if it supports a decision. By looking at consequences for people and society as well as for the organisation, this clause makes managers face effects that a financial register would miss, such as uneven treatment of a small group of users or harm to an affected employee. Repeatability means that next year's result can be compared with this year's, so improvement or deterioration is visible. It also protects against optimism, where missing evidence is treated as no risk. For customers, a consistent method gives confidence that approval does not depend on who happened to run the workshop, and it speeds reassessment when a supplier or use changes.
How to implement clause 6.1.2
Design the method around scenarios that matter, and make assumptions visible so decision-makers can see where evidence is thin.
- Link the process explicitly to the AI policy and objectives, stating what each assessment is meant to support.
- Write scenarios that describe how an AI use could go wrong or fall short, including consequences for people outside the organisation.
- Define how likelihood is judged where it applies, and how uncertainty is shown instead of hidden behind a score.
- Evaluate results against the agreed criteria and list priorities for treatment, with the reasons.
- Set rules for who may run assessments, what evidence they need and how outputs are reviewed so repeat assessments stay comparable.
- Define triggers for reassessment such as new users, a different decision resting on the output or changed supplier behaviour.
- Keep results, including earlier ones, so the history of conclusions can be explained, and compare successive assessments to understand why a conclusion moved.
Example: manufacturing demand forecasts
A hypothetical manufacturer uses AI to forecast demand and recommend production quantities. Managers want to reduce excess stock. A useful scenario examines what happens when demand shifts outside the historical pattern and the recommendation leads to shortages of a critical customer product.
The consequences include the manufacturer's commercial exposure, but the assessment should also consider relevant effects on others in the actual context. The response depends on the use and product. A decorative item and a component supporting an important service may present different consequence profiles. The example illustrates why “forecast error” alone is too vague to establish a priority.
Existing human review may affect the assessment, but its actual capability matters. If planners lack information to recognise the unusual pattern, assuming that a person will catch the issue can understate the exposure.
Example: software that ranks support requests
A software provider offers AI-assisted ranking of support requests. A customer intends to use the ranking to determine response order. The assessment considers how incorrect or uneven ranking could affect users, including those whose descriptions differ from the material used to evaluate the service.
The organisation can use impact-assessment findings to understand affected groups and consequences. It should then connect that information with the risk criteria and treatment priorities. A high overall success rate does not explain whether a small group consistently receives inappropriate priority.
This does not mean every difference proves unfair treatment or nonconformity. It means the assessment needs sufficient evidence and context to investigate consequential differences rather than hide them in an aggregate result.
Connect assessment with treatment and change
The output should support a decision about which risks need treatment and why. It need not prescribe a technical solution before appropriate expertise has considered the options. Make responsibilities and unresolved assumptions visible so the treatment process can use the assessment effectively.
Under clause 8.2, reassessment occurs at planned intervals and when significant changes are proposed or occur; all results are retained. Suggested changes to examine include new users, a different decision influenced by the output, changed supplier behaviour or a new operating environment. These examples help recognise significance but do not replace the organisation's defined process.
Evidence and common assessment mistakes
An auditor may follow a scenario from objectives and assessment criteria to supporting evidence, consequence analysis, prioritisation and treatment. They may compare earlier and later results to understand why the conclusion changed. Retaining only the latest favourable score can erase useful history and make the process difficult to explain.
Other weaknesses include copying the same risk description across unlike uses, treating every uncertainty as negligible because evidence is unavailable, and considering only the organisation's losses. Distinguish risk assessment from legal clearance, and obtain appropriate specialist input where needed.
Frequently asked questions
Is this the same as information security risk assessment?
There can be overlap, but AI assessment addresses a broader set of relevant objectives and consequences. An information security register alone may not answer those questions.
Must every risk have a probability percentage?
No. The clause addresses realistic likelihood where applicable; use a method appropriate to the context and explain uncertainty.
What makes reassessment useful?
It examines changed conditions and evidence using the established method. Updating a date without reconsidering assumptions is not a meaningful reassessment.
Develop a defensible AI risk method
Discuss AI risk assessment with Sterling, including scoped facilitation and agreed Effivity ISO & GRC automation software. Enrol in AI Risk & Impact Assessment to strengthen understanding before applying your own method. Independent bodies decide AIMS certification, which does not certify each product.
Parent: clause 6. Previous: scope. Next: risk treatment and SoA. Return to the hub.