AI system impact assessment process

Put in place a way of assessing what an AI system could mean for individuals, groups of individuals and societies across its life cycle. In practice the record is impact assessment procedure stating triggers (criticality of purpose, complexity and automation, data sensitivity, significant changes). For ai system impact assessment process the evidence is the signed assessment, not the process diagram.

What it asks

Put in place a way of assessing what an AI system could mean for individuals, groups of individuals and societies across its life cycle.

Where generative AI changes the answer

An impact assessment for generative AI has to name the people whose data or work appears in the output, including people who never interact with the system.

Who it binds

The AI system owner and the impact assessment reviewer. For A.5.2 the named role is the owner of impact assessment procedure stating triggers (criticality of purpose, complexity and automation, data sensitivity, significant changes).

Evidence an auditor normally samples

• Impact assessment procedure stating triggers (criticality of purpose, complexity and automation, data sensitivity, significant changes)
• Process steps: identification, analysis, evaluation, treatment, documentation and communication
• Named assessors and the way results inform design or use

The test you can run

Compare impact assessment procedure stating triggers (criticality of purpose, complexity and automation, data sensitivity, significant changes) with the use as it runs today; the gap between the two is the finding to record.

Common failures

• No defined triggers, so assessments are optional
• Assessment results never feed design decisions

Before the draft publishes

For A.5.2, run one impact assessment on a live use, name the people affected, and keep the signed record with the deployment decision. The first artefact to produce is impact assessment procedure stating triggers (criticality of purpose, complexity and automation, data sensitivity, significant changes).

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.5.2 (ai system impact assessment process) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.