# A.5.4 Assessing AI system impact on individuals or groups of individuals

Evaluate and record how AI systems could affect individuals or groups of individuals over the system's life cycle. In practice the record is individual and group impact assessment covering human rights, accessibility, financial consequences, health and safety, privacy and security, explainability and transparency, accountability and fairness. For assessing ai system impact on individuals or groups of individuals the evidence is the signed assessment, not the process diagram.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.5.4
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Evaluate and record how AI systems could affect individuals or groups of individuals over the system's life cycle.

## Where generative AI changes the answer

Individual impact is where a fabricated detail about a real person becomes the harm, and it is easy to miss because the output looks generic.

## Who it binds

The AI system owner and the impact assessment reviewer.

## Evidence an auditor samples

- Individual and group impact assessment covering human rights, accessibility, financial consequences, health and safety, privacy and security, explainability and transparency, accountability and fairness
- Consideration of vulnerable groups such as children, elderly or impaired persons and workers
- Records of expert consultation where needed

## The test you can run

Ask for the signed impact assessment for the use, and read the section on people who never interact with it.

## Common failures

- Vulnerable groups not considered
- Only privacy impacts assessed

## Before the draft publishes

Run one impact assessment on a live use, name the people affected, and keep the signed record with the deployment decision.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.