# A.5.2 AI system impact assessment process

Put in place a way of assessing what an AI system could mean for individuals, groups of individuals and societies across its life cycle. In practice the record is impact assessment procedure stating triggers (criticality of purpose, complexity and automation, data sensitivity, significant changes). For ai system impact assessment process the evidence is the signed assessment, not the process diagram.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.5.2
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Put in place a way of assessing what an AI system could mean for individuals, groups of individuals and societies across its life cycle.

## Where generative AI changes the answer

An impact assessment for generative AI has to name the people whose data or work appears in the output, including people who never interact with the system.

## Who it binds

The AI system owner and the impact assessment reviewer.

## Evidence an auditor samples

- Impact assessment procedure stating triggers (criticality of purpose, complexity and automation, data sensitivity, significant changes)
- Process steps: identification, analysis, evaluation, treatment, documentation and communication
- Named assessors and the way results inform design or use

## The test you can run

Ask for the signed impact assessment for the use, and read the section on people who never interact with it.

## Common failures

- No defined triggers, so assessments are optional
- Assessment results never feed design decisions

## Before the draft publishes

Run one impact assessment on a live use, name the people affected, and keep the signed record with the deployment decision.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.