For Heads-of · Practitioner
ISO/IEC 42005
Also known as: ISO 42005
The international standard, published in May 2025, giving guidance on how to carry out an AI system impact assessment: identifying the people and groups a system affects and assessing its potential benefits and harms. It is the method ISO/IEC 42001 assumes.
- ISO
- impact assessment
- AIMS
- standards
- FRIA
What it covers
Scoping the system and its context, identifying stakeholders and affected groups, assessing reasonably foreseeable benefits and harms (including from misuse), documenting the results, and feeding them into risk management and decisions about the system. It applies throughout the lifecycle, not only before deployment.
How it fits
ISO/IEC 42001 requires an AI system impact assessment (Clause 6.1.4) but does not say how to do it; 42005 does. It is guidance, so an organisation cannot be certified against it. It overlaps with the EU AI Act's fundamental rights impact assessment and with a DPIA, and one well-run process can serve all three; see impact assessment and ISO/IEC 42001.
Where it sits in the register
The gap it closes is missing AI impact assessment process; the control is the AI impact assessment process.
Sources
Related Terms
High-Risk AI System
An AI system that the EU AI Act subjects to its full set of requirements, either because it is a safety component of a product covered by EU product law (Annex I) or because it is used in one of eight listed areas (Annex III), which include credit scoring and life and health insurance pricing. Since the 2026 Digital Omnibus the obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
Impact Assessment
A systematic evaluation of the potential positive and negative effects of deploying an AI system on individuals, communities and society. Distinct from a data protection impact assessment, which examines the lawfulness of the data processing rather than the consequences of the decision.
ISO/IEC 23894
International guidance, published in 2023, on managing risk related to AI. It applies the general risk management principles of ISO 31000 to AI and adds what is specific to AI systems.
ISO/IEC 42001
The international standard for an AI management system (AIMS): the policies, roles, risk assessment, impact assessment, controls and evidence an organisation puts around its development and use of AI so that the whole can be audited and certified. Published December 2023, and since 2025 surrounded by companion standards for impact assessment (42005) and for the bodies that certify against it (42006), and from 2026 by EN 18286, the European quality management standard written for the EU AI Act.