ISO 42001 AI Impact Assessment: Examine Who May Be Affected

What clause 6.1.4 requires in practice

Clause 6.1.4 requires the organisation to set up a process for assessing what could follow for individuals, groups of people and societies from developing, providing or using AI systems. The assessment must determine the consequences of an AI system's deployment, its intended use and its foreseeable misuse. It takes account of the specific technical and societal context in which the system is deployed and of applicable jurisdictions.

The result must be documented. Where appropriate, the organisation may make it available to relevant interested parties that it defines. The organisation must consider the results when carrying out the AI risk assessment under clause 6.1.2, and Annex A theme A.5 provides related controls. A note observes that safety-critical or privacy-critical contexts may call for discipline-specific impact assessments as part of wider risk management. Clause 8.4 requires the assessment to be carried out at planned intervals and when significant changes are proposed, and results kept. Public disclosure of every result is not required.

Follow the consequence beyond the organisation's balance sheet

A business may first notice cost, speed or customer satisfaction. Impact assessment also examines consequences for people and society, including those who do not buy the service or participate in the project. The relevant effects depend on the purpose and context, so a generic list of abstract ethical topics is insufficient by itself.

Suggested practice is to follow a pathway from an input or decision through the AI output to the action someone takes. Identify who can benefit, who can be disadvantaged, who can challenge a result and what happens when the output is wrong or misused. These prompts help organise an assessment; they are not additional prescribed clause headings.

Why impact assessment matters to the business

Business cases usually count cost, speed and satisfaction. Impact assessment adds the people who bear the consequences of AI outputs without ever appearing in a contract: employees affected by scheduling, applicants affected by scoring, communities affected by automated decisions. Looking at them early helps avoid harm, complaints and the reputational cost of discovering a problem through the press or a regulator. It also gives customers evidence that the supplier thought about foreseeable misuse rather than only intended use. Because findings must inform the risk assessment, the work pays off by improving decisions on controls and restrictions, not by generating a report that sits unread.

How to implement clause 6.1.4

Make the assessment a structured conversation about consequences, scaled to the use. Longer reports are not better; decisions that change because of the findings are.

1. Describe the use as a pathway from input through AI output to the action someone takes on it.
2. Identify who could benefit, who could be disadvantaged and who can challenge a result, including people who never use the system.
3. Consider foreseeable misuse, such as the same output being reused to judge individuals, and the specific deployment context and jurisdiction.
4. Involve people with knowledge of the affected groups and the local setting, and obtain specialist input where safety or privacy is critical.
5. Document the findings, including uncertainties, and record what the organisation decided to do about each significant consequence.
6. Pass the findings to the risk assessment and decide which results may be shared with interested parties.
7. Set triggers for repeating the assessment when the population, purpose or operating environment changes.

Example: a BPO workforce-planning proposal

Example: construction site image analysis

A construction company proposes using AI to analyse site images for progress reporting. The initial purpose concerns completion status. Later, managers suggest using the same outputs to compare individual subcontractor performance. People may be affected in different ways by that extended use, especially if images do not capture weather, access restrictions or work completed outside the camera's view.

The impact assessment should examine the proposed purpose and foreseeable misuse, not only the technical accuracy of recognising visible objects. It should consider how a report might influence payment discussions, work allocation or reputation, and which contextual information is needed to avoid misleading conclusions.

The organisation's responsibilities and any applicable obligations require separate attention. An AIMS assessment cannot certify that the construction activity is safe or that every use of images is legally authorised.

Connect impact findings with AI risk assessment

Results of the impact assessment are documented and considered in the AI risk assessment under clause 6.1.2. Where appropriate, results can be made available to relevant interested parties as defined by the organisation. The standard does not impose unrestricted public disclosure of every assessment.

Keep the connection visible. If the impact work identifies an affected group or a consequence previously overlooked, the risk assessment should not continue unchanged without explanation. Conversely, risk analysis may reveal uncertainty that warrants more detailed impact investigation. The processes can inform each other while retaining their distinct purposes.

In some contexts, additional safety, privacy, security or other discipline-specific assessment may be needed. Integrate relevant conclusions and specialist input rather than assuming one general AIMS form answers every technical or legal question.

Repeat assessment when the context calls for it

Clause 8.4 requires impact assessment at planned intervals and when significant changes are proposed. A new population, purpose, operating environment or consequential decision can change the impact picture even if the model stays the same. These are suggested examples of changes to examine, not an exhaustive trigger list.

For the construction example, repurposing progress images for performance evaluation deserves attention before the earlier assessment is assumed to cover it. Retain all results so the organisation can understand the conditions and reasoning behind previous decisions, including limitations and subsequent changes.

Evidence and mistakes to avoid