AI impact assessment (AISIA) for ISO 42001

The AI System Impact Assessment (AISIA) is a distinctive element of ISO 42001 . It goes further than a standard risk analysis. The EU AI Act requires similar analyses for high-risk AI. You look not only at what could go wrong, but at the consequences for people and society.

Why an AI impact assessment in ISO 42001?

AI is different from traditional software. AI systems can make decisions that directly affect people. Rejecting a credit application. Rejecting a job applicant. Making a medical diagnosis. Flagging a person as a suspect.

If those decisions are wrong, or systematically disadvantage certain groups, real people suffer real consequences. The impact assessment forces you to think about this before you put AI into live use.

The risk analysis asks: what could go wrong, and how likely is it? The impact assessment asks: if it does go wrong, who is affected and how serious is that?

Impact versus risk

The distinction is subtle but important.

Risk analysis

Focus: threats and vulnerabilities
Question: what could go wrong?
Perspective: the organisation
Output: risk scores, control measures

Impact assessment

Focus: consequences for people and society
Question: who is affected, and how seriously?
Perspective: the stakeholders
Output: impact evaluation, mitigation measures

You need both. The risk analysis looks at the system. The impact assessment looks at the world in which the system operates.

For high-risk AI systems, the EU AI Act also requires an assessment of the impact on fundamental rights. The AISIA in ISO 42001 helps you meet this requirement.

When do you carry out an impact assessment?

The impact assessment is not a one-off exercise.

For new AI systems. Before you put a new AI system into production, you assess its impact.

For significant changes. When an existing system changes substantially, gets new use cases, or is applied to different target groups.

Periodically. Even without changes, the world changes. Periodic reassessment is sensible.

After incidents. If something goes wrong, you reassess the impact.

The 7 steps of an ISO 42001 impact assessment, step by step

Step	Activity	Purpose
1	Describe the AI system	Understand what the system does and decides
2	Identify the stakeholders	Map out who is affected
3	Assess the impact on individuals	Look at fairness, privacy and safety
4	Assess the societal impact	Think bigger: employment, public trust
5	Assess the severity	Determine scale, intensity and reversibility
6	Identify mitigation measures	Determine how you limit negative impact
7	Document and maintain	Record it and plan reassessments

Involve people with different backgrounds in every impact assessment: technical, legal, ethical and business. This prevents the blind spots that one person working alone will inevitably leave.

Step 1: Describe the AI system

Start with a clear description of the AI system.

What does the system do?
What is it used for?
Which decisions does it influence?
Who are the users?
Who does it have an impact on?

Be concrete. “The system supports credit decisions” is too vague. “The system generates a risk score for credit applications, which employees use to approve or reject applications” is better.

Step 2: Identify the stakeholders

Who is affected by this AI system? Think broadly.

Direct stakeholders:

The people about whom decisions are made (applicants, job applicants, patients)
Users of the system (employees, customers)

Indirect stakeholders:

Family or relatives of direct stakeholders
Competitors or market parties
Society at large

For each group: how are they affected? Positively or negatively? Directly or indirectly?

Step 3: Assess the impact on individuals

Now you look at the specific impact on individuals. The standard explicitly mentions:

Fairness Does the system treat everyone fairly? Are there groups that are systematically disadvantaged? Is there bias in the data or the model?

Example: a recruitment system that systematically scores women lower because of historical patterns in the training data.

Privacy How does the system handle personal data? Are profiles created? Can individuals be identified?

Safety Can the system cause physical or psychological harm? Think of medical systems and autonomous vehicles, but also content recommendation systems.

Autonomy Does the system influence people’s freedom of choice? Are people manipulated or steered without knowing it?

Dignity Is human dignity respected? Think of systems that categorise or dehumanise people.

Step 4: Assess the societal impact

Look beyond individuals too.

Employment Does the system lead to job losses? Does it change the nature of work?

Public trust How does the system affect trust in AI, in your organisation, in institutions?

Social dynamics Does the system reinforce existing inequalities? Does it create new divisions?

Democracy and the rule of law For systems in the public sector: how does it affect democratic principles?

Step 5: Assess the severity

For each identified impact, you determine its severity.

Scale How many people are affected? One person, hundreds, millions?

Intensity How severe is the impact? A minor annoyance, a financial setback, life-threatening consequences?

Reversibility Can the impact be undone? A wrong recommendation is easier to correct than a rejected loan or a missed diagnosis.

Vulnerability Are those affected particularly vulnerable? Children, older people, people with disabilities, people in dependent positions?

Step 6: Identify mitigation measures

For significant negative impacts, you determine what you will do about them.

Possible measures:

Adjusting the system (correcting bias, increasing transparency)
Building in human oversight
Offering routes to appeal
Providing information to those affected
Monitoring and alerting
Limiting the application
Not implementing it (if the impact is too great)

Step 7: Document and maintain

Record the impact assessment. Document:

The description of the system
The stakeholders identified
The impacts assessed
The severity
The measures taken
The residual risks

Plan when you will repeat or update the assessment.

Example: credit assessment

A concrete example makes it tangible.

System: AI model that scores credit applications for risk.

Stakeholders:

Credit applicants (direct)
Partners or families of applicants (indirect)
Employees who work with the score
Society (lending affects the economy)

Impact on individuals:

Fairness: Risk that certain groups systematically receive higher risk scores because of correlations with protected characteristics. For example: postcode correlates with ethnicity, which can lead to indirect discrimination.

Privacy: The model uses personal data. Profiles are created. People may not know which data is being used.

Autonomy: A rejected loan restricts freedom of choice (being unable to buy a home or start a business).

Societal impact:

Inequality: If the model systematically rejects certain groups, it reinforces existing economic inequality.

Mitigation measures:

Bias analysis on training data and model outcomes
Prohibition on using protected characteristics and proxies
Explainability: applicants can ask why they were rejected
Human review in borderline cases
An appeal procedure
Periodic audit on fairness

Common pitfalls in the AI impact assessment

Too technical. The impact assessment is not a technical exercise. It is about people, not algorithms.

Too superficial. “We treat everyone equally” is not an assessment. You must look concretely at how the system works out in practice.

Only the happy path. Also look at what happens when things go wrong. And at edge cases.

One-off. The world changes. Your AI system changes. The impact assessment must keep pace.

No consequences. An impact assessment that is documented but does not lead to action is pointless.

The impact assessment is not optional or nice-to-have. It is a core requirement of ISO 42001. The auditor will ask to see impact assessments and check that they were carried out seriously.

Relationship with other frameworks

The AISIA in ISO 42001 does not stand alone.

EU AI Act Fundamental Rights Impact Assessment. The AI Act requires an assessment of the impact on fundamental rights for high-risk systems. The AISIA overlaps strongly with this.

Data Protection Impact Assessment (DPIA). Under the Dutch GDPR (AVG, General Data Protection Regulation), you must carry out a DPIA for high-risk data processing. There is overlap: privacy is part of the impact assessment.

Ethical AI assessments. Various organisations (IEEE, OECD) have published ethical frameworks. The AISIA is consistent with these.

You can integrate these assessments. One document that covers all perspectives is more efficient than separate documents that overlap.

Getting started in practice

If you have no experience with impact assessments yet, start small.

Choose one AI system. Preferably one with a clear impact on people.

Work through the steps. Use the structure on this page.

Involve others. This is not a one-person job. Involve people with different perspectives: technical, legal, ethical, business.

Be honest. The goal is not to produce a nice-looking document, but to identify and address real risks.

Learn and improve. Your first impact assessment will not be perfect. Learn from it and improve the process.