Assessing societal impacts of AI systems

Evaluate and record the possible effects of the organization's AI systems on society over their life cycle. In practice the record is societal impact assessment covering environmental sustainability, economic effects, government and democratic processes, health and safety, and norms and culture. For assessing societal impacts of ai systems the evidence is the signed assessment, not the process diagram.

What it asks

Evaluate and record the possible effects of the organization's AI systems on society over their life cycle.

Where generative AI changes the answer

Societal impact covers the aggregate effect of many outputs, including how the system shapes what customers and staff believe.

Who it binds

The AI system owner and the impact assessment reviewer. For A.5.5 the named role is the owner of societal impact assessment covering environmental sustainability, economic effects, government and democratic processes, health and safety, and norms and culture.

Evidence an auditor normally samples

• Societal impact assessment covering environmental sustainability, economic effects, government and democratic processes, health and safety, and norms and culture
• Analysis of misuse potential and reinforcement of historical bias
• Link to environmental sustainability goals

The test you can run

Compare societal impact assessment covering environmental sustainability, economic effects, government and democratic processes, health and safety, and norms and culture with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Environmental footprint of AI omitted
• Misuse scenarios such as misinformation not analysed

Before the draft publishes

For A.5.5, run one impact assessment on a live use, name the people affected, and keep the signed record with the deployment decision. The first artefact to produce is societal impact assessment covering environmental sustainability, economic effects, government and democratic processes, health and safety, and norms and culture.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.5.5 (assessing societal impacts of ai systems) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.