Documentation of AI system impact assessments

Record what each AI system impact assessment finds and retain those records for a set period. In practice the record is impact assessment records covering intended use and foreseeable misuse, positive and negative impacts, predictable failures and mitigations, relevant demographic groups, system complexity, the human role and oversight, and employment and skills effects. For documentation of ai system impact assessments the evidence is the signed assessment, not the process diagram.

What it asks

Record what each AI system impact assessment finds and retain those records for a set period.

Where generative AI changes the answer

The written impact assessment is what lets a later reviewer see that a harm was considered before deployment rather than after a complaint.

Who it binds

The AI system owner and the impact assessment reviewer. For A.5.3 the named role is the owner of impact assessment records covering intended use and foreseeable misuse, positive and negative impacts, predictable failures and mitigations, relevant demographic groups, system complexity, the human role and oversight, and employment and skills effects.

Evidence an auditor normally samples

• Impact assessment records covering intended use and foreseeable misuse, positive and negative impacts, predictable failures and mitigations, relevant demographic groups, system complexity, the human role and oversight, and employment and skills effects
• Retention schedule for assessments

The test you can run

Compare impact assessment records covering intended use and foreseeable misuse, positive and negative impacts, predictable failures and mitigations, relevant demographic groups, system complexity, the human role and oversight, and employment and skills effects with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Assessments overwritten with no history
• No defined retention period

Before the draft publishes

For A.5.3, run one impact assessment on a live use, name the people affected, and keep the signed record with the deployment decision. The first artefact to produce is impact assessment records covering intended use and foreseeable misuse, positive and negative impacts, predictable failures and mitigations, relevant demographic groups, system complexity, the human role and oversight, and employment and skills effects.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.5.3 (documentation of ai system impact assessments) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.