ISO 42005 AI system impact assessment, done properly and ready to show.

What it is

What is ISO 42005 and what is it used for?

ISO/IEC 42005 is the international guidance on AI system impact assessment, prepared by the joint ISO and IEC subcommittee for artificial intelligence, JTC 1/SC 42. It helps an organisation identify, evaluate and document the potential effects of an AI system, and of the uses it can reasonably be put to, on individuals, groups of people and society, across the whole life cycle from design to monitoring in service.

The point is accountability you can show. A hiring tool that screens out a group, a chatbot that gives unsafe advice or a scoring model that nobody can explain are impacts, not only technical faults. ISO/IEC 42005 gives the questions, the roles and the record that make such effects visible before launch and keep them visible afterwards. It sits beside ISO/IEC 42001 for AI management systems, ISO/IEC 23894 for AI risk management and ISO/IEC 38507 for governance, and focuses on the human and societal side those standards reference.

Current edition. ISO/IEC 42005:2025, the first edition, published by ISO in May 2025. ISO shows no amendment or revision in progress, so there is nothing to transition. It is guidance: organisations align with it, and no certification body certifies against it. Organisations using ISO/IEC 42001 can use it to design the impact assessment their management system requires. AI system impact assessment, with ISO/IEC 42005

Who it is for

Who needs ISO 42005?

Any organisation that builds, sells or relies on AI, from a software firm shipping a model to a bank, hospital or BPO using a vendor's system in decisions about people. Four situations usually bring it onto the agenda:

• A customer asks how you assess your AI. Enterprise buyers now send AI questionnaires alongside security ones. A documented ISO/IEC 42005 assessment per system answers them with evidence rather than assurances.
• A tender asks for responsible AI evidence. Public and regulated buyers want to see impacts considered, owners named and harms addressed. An assessment file built to international guidance travels well between bids.
• A regulator expects an assessment. Rules such as the EU AI Act place assessment duties on some providers and deployers. ISO/IEC 42005 gives a structured method; your legal advisers confirm what the law itself demands.
• Group policy calls for one method. Subsidiaries assessing AI in different ways leave the board without a comparable picture. One process, thresholds and template across the group fixes that, and feeds an ISO/IEC 42001 system if you pursue certification.

Requirements

What are the ISO 42005 requirements?

Strictly, ISO/IEC 42005 sets recommendations, not auditable requirements, because it is guidance. Its guidance sits in two main clauses, one on building the assessment process and one on what each assessment should document, followed by five informative annexes. Titles are summarised here; your process is checked against the standard itself during the programme.

• Clauses 1 to 4 Scope, references, terms and abbreviations: what the document covers and the vocabulary it uses.
• Clause 5 The assessment process, set-up: document the process, integrate it with your other management processes, decide when assessments happen and what each one covers.
• Clause 5 The assessment process, roles and thresholds: allocate responsibilities and set thresholds for sensitive uses, restricted uses and impact scales.
• Clause 5 The assessment process, carrying it out: perform the assessment, analyse the results, record and report them, approve them and monitor and review over time.
• Clause 6 Documenting the assessment, the system: scope, a description of the AI system, its functions, purpose, intended uses and unintended uses.
• Clause 6 Documenting the assessment, data, models and setting: data information and quality, algorithm and model information, and the deployment environment, including geography and languages.
• Clause 6 Documenting the assessment, people and impacts: directly affected and other relevant interested parties, benefits and harms, failures and reasonably foreseeable misuse, and the measures to address harms and benefits.
• Annexes A to E: guidance for use with ISO/IEC 42001 and with ISO/IEC 23894, a harms and benefits taxonomy, aligning with other assessments, and an example assessment template.

Putting it into practice

How do you implement ISO 42005?

There is no audit to pass, so the test is whether assessments happen, on time, for every system that matters. Five steps take you there:

1. 01
   List the AI systems and decide what is in scope.Every system you develop, provide or use, your role for each, the people it reaches and the decisions it touches.
2. 02
   Gap analysis: compare current practice with the guidance.Existing privacy, risk and ethics reviews are measured against ISO/IEC 42005, keeping what works and agreeing actions and owners.
3. 03
   Design the process.Timing, responsibilities, thresholds for sensitive and restricted uses, impact scales, approval routes and a template adapted to your systems.
4. 04
   Assess the priority systems.Workshops with product, data, legal and business owners produce the first completed assessments, with measures and approvals recorded.
5. 05
   Monitor, review and connect.Reassessment on change and on schedule, reporting to management, and links into ISO/IEC 42001, risk registers or other assessments.

Check the route before you sign. No body can certify you to ISO/IEC 42005, so treat any "ISO 42005 certificate" offer as a warning sign. If a customer needs a certificate, the route is ISO/IEC 42001 through an accredited certification body; confirm its accreditation for that standard, recognised through the Global ACI arrangement, on the accreditation body's public register. The certification buyer's checklist

Cost

How much does ISO 42005 implementation cost?

The price follows the number of AI systems and how much each one can affect people, not headcount alone. One internal assistant is a different task from a portfolio of customer-facing models in lending or health. Every component is visible in a Sterling proposal, and nothing is added later.

Timeline

How long does ISO 42005 implementation take?

Pace depends on how quickly system owners and data teams are available, how much is known about third-party models and how many systems need a full assessment. As an estimate, a first process with the priority systems assessed takes two to four months; the remaining systems follow on a schedule set by their risk.

Your engagement

What your ISO 42005 engagement includes

One team takes you from the first inventory to assessments your people run on their own. Sterling does not certify, and no certificate exists for ISO/IEC 42005; our work is the process, the first assessments and the capability to keep them current.

• Inventory, gap analysis and plan

  Systems, owners, priorities and dates agreed before work starts.

• Process and template

  Built on the ISO/IEC 42005 structure and adapted to how your teams build and procure AI.

• Effivity ISO & GRC software

  Assessments, approvals and review dates in one place, included with the engagement at no additional cost.

• Training

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• First assessments

  Facilitated with your owners for the priority systems, with measures and approvals recorded.

• Review and connection

  Reporting to management and links into ISO/IEC 42001 or other assessments where you run them.

You choose the level of support under Sterling OS™. With Design™ we guide and your team does the work; with Drive™ we manage delivery and your people approve and own it. Either is a complete route on its own. Sustain™ follows once the process is running, keeping reassessments on schedule, and Automate™ is Effivity.

Where ISO/IEC 42001 certification is added, certification decisions remain with the independent certification body.

Often combined with

Standards organisations pair with ISO/IEC 42005

• EU AI ActEU AI Act compliance consulting: classify each AI system, document high-risk requirements and transparency duties, and prepare conformity assessment evidence.
• ISO/IEC 23894ISO 23894 AI risk management made practical: the ISO 31000-based guidance, its structure, no certificate, and how Sterling builds it, with a route to ISO 42001.
• ISO/IEC 38507ISO 38507 AI governance and requirements explained: the 2022 guidance for boards on AI use, why no certificate exists and how Sterling puts it into practice.
• ISO/IEC 42001ISO/IEC 42001 certification consulting for AI governance: risks and impacts assessed, treated and evidenced, then supported through the certification audit.
• ISO/IEC 42006ISO 42006 explained: the requirements for bodies that audit and certify ISO/IEC 42001 AI management systems, how accreditation works and what to check.
• ISO/IEC 5338ISO/IEC 5338 AI life cycle processes explained: the 2023 process groups, what they ask of AI teams, why there is no certificate and how Sterling helps.