# A.5.3 Documentation of AI system impact assessments

Record what each AI system impact assessment finds and retain those records for a set period. In practice the record is impact assessment records covering intended use and foreseeable misuse, positive and negative impacts, predictable failures and mitigations, relevant demographic groups, system complexity, the human role and oversight, and employment and skills effects. For documentation of ai system impact assessments the evidence is the signed assessment, not the process diagram.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.5.3
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Record what each AI system impact assessment finds and retain those records for a set period.

## Where generative AI changes the answer

The written impact assessment is what lets a later reviewer see that a harm was considered before deployment rather than after a complaint.

## Who it binds

The AI system owner and the impact assessment reviewer.

## Evidence an auditor samples

- Impact assessment records covering intended use and foreseeable misuse, positive and negative impacts, predictable failures and mitigations, relevant demographic groups, system complexity, the human role and oversight, and employment and skills effects
- Retention schedule for assessments

## The test you can run

Ask for the signed impact assessment for the use, and read the section on people who never interact with it.

## Common failures

- Assessments overwritten with no history
- No defined retention period

## Before the draft publishes

Run one impact assessment on a live use, name the people affected, and keep the signed record with the deployment decision.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.