Assessing AI system impact on individuals or groups of individuals

Evaluate and record how AI systems could affect individuals or groups of individuals over the system's life cycle. In practice the record is individual and group impact assessment covering human rights, accessibility, financial consequences, health and safety, privacy and security, explainability and transparency, accountability and fairness. For assessing ai system impact on individuals or groups of individuals the evidence is the signed assessment, not the process diagram.

What it asks

Evaluate and record how AI systems could affect individuals or groups of individuals over the system's life cycle.

Where generative AI changes the answer

Individual impact is where a fabricated detail about a real person becomes the harm, and it is easy to miss because the output looks generic.

Who it binds

The AI system owner and the impact assessment reviewer. For A.5.4 the named role is the owner of individual and group impact assessment covering human rights, accessibility, financial consequences, health and safety, privacy and security, explainability and transparency, accountability and fairness.

Evidence an auditor normally samples

• Individual and group impact assessment covering human rights, accessibility, financial consequences, health and safety, privacy and security, explainability and transparency, accountability and fairness
• Consideration of vulnerable groups such as children, elderly or impaired persons and workers
• Records of expert consultation where needed

The test you can run

Compare individual and group impact assessment covering human rights, accessibility, financial consequences, health and safety, privacy and security, explainability and transparency, accountability and fairness with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Vulnerable groups not considered
• Only privacy impacts assessed

Before the draft publishes

For A.5.4, run one impact assessment on a live use, name the people affected, and keep the signed record with the deployment decision. The first artefact to produce is individual and group impact assessment covering human rights, accessibility, financial consequences, health and safety, privacy and security, explainability and transparency, accountability and fairness.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.5.4 (assessing ai system impact on individuals or groups of individuals) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.