ISO 42001 Clause 8.4: Keep AI Impact Assessments Current

What clause 8.4 requires in practice

Clause 8.4 keeps AI system impact assessment alive during operation. The organisation performs impact assessments following the process defined in clause 6.1.4, on a planned schedule and whenever significant changes are proposed. Note the wording: here the change trigger is framed around proposed changes, so the thinking should happen before a consequential extension is introduced, not afterwards. The impact process looks at consequences for individuals, groups and society.

The clause then requires the organisation to keep documented information on the outcomes of every AI system impact assessment. The practical outputs are a schedule or trigger arrangement for reassessing impact, completed assessments that reflect the current deployment and intended use, and a retained history. Findings are meant to feed back into risk assessment and into the conditions under which the system operates.

Revisit the effect of the use, not just the tool

A proposed extension can change who is affected and how, even if the technology remains unchanged. As an original reassessment prompt, follow the output into the decision someone will take. Ask whether that decision differs from the purpose examined earlier, which people may experience consequences and what context the earlier assessment did not cover.

The process should consider deployment, intended use and foreseeable misuse in the relevant technical, societal and jurisdictional setting. Appropriate specialist assessment may also be needed. An AIMS impact assessment is not legal permission or product approval.

Why clause 8.4 matters to the business

Impact is where AI governance meets real people: customers, employees and communities who may never see the technology but live with its decisions. Businesses that assess impact only once tend to be surprised when a tool is repurposed, for example from summarising information to influencing eligibility or performance judgements. Reassessing before the change protects individuals and protects the organisation from reputational damage, complaints and contractual disputes. It also helps sales teams answer client questions with substance. Keeping every result shows regulators and auditors that the organisation looked accurately at consequences, including unresolved uncertainty, and not merely at technical accuracy.

How to implement clause 8.4

Tie impact reassessment to proposals, not just calendars. One sequence that Sterling teams apply is set out below, and it can be scaled to the size of the use concerned.

1. Describe the current deployment, intended use and foreseeable misuse in a short, plain statement that can be compared with later proposals.
2. Add a question to your change-request route asking who will be affected differently and what decision the output will now influence.
3. Define planned intervals by the pace of change and consequence of each use, rather than a single annual date for all systems.
4. Bring in people who know the affected groups, such as client representatives, front-line staff or domain specialists.
5. Check whether the technical accuracy report is being used as a substitute for a real discussion of effects.
6. Retain each assessment with the context examined, including uncertainties that remain unresolved.
7. Feed findings into risk assessment and communicate any changed conditions to the operating teams.

Illustrative manufacturing example: inspection becomes worker ranking

Illustrative BPO example: summaries become service eligibility advice

A BPO team uses AI to summarise customer enquiries for staff. A client asks it to add suggestions about whether a customer qualifies for a service. The output would now influence a consequential decision rather than simply help an employee locate information.

The BPO examines how customers could be affected by inaccurate or incomplete suggestions and what opportunities exist to correct information or challenge the result. It brings relevant client and domain knowledge into the assessment. A demonstration that the summary function works well does not establish suitability for the proposed advisory purpose.

Plan reassessment and preserve context

Set planned intervals appropriate to the organisation and use, and maintain a route for proposed significant changes to be considered. Clause 8.4 does not prescribe one annual date for every system. A schedule should not become a reason to postpone attention to a proposed change that materially alters consequences.

Retain all results with enough context to explain the deployment and purpose examined. If different locations or populations are grouped, understand why the assessment remains meaningful for them. A single global conclusion can miss a locally important effect.

Connect findings with risk and operation

The defined impact process requires its results to inform AI risk assessment. New consequences should therefore reach the people evaluating and treating risks. Where findings change approved conditions, communicate the result to those operating the service.

The Annex A impact-assessment controls provide related control guidance about process, documentation and different levels of impact. They support the management-system requirements without creating a universal assessment format.

Evidence and common mistakes