Skip to main content
Bureau of AI
Category: Risk Assessment & Analysis

Impact Assessment (ISO/IEC 42005)

Also known as: AI System Impact Assessment, ISO/IEC 42005, ISO 42005
Simply put

An AI system impact assessment, as addressed by ISO/IEC 42005, is a structured way for an organization to examine how an AI system could affect individuals, groups, and society. The standard provides guidance for conducting these assessments so that potential impacts can be considered before a system is deployed and monitored after it is in use. It is described as guidance rather than a binding law, and it is voluntary in nature.

Formal definition

ISO/IEC 42005:2025 is an international standard, published by ISO and IEC, that provides guidance for organizations conducting AI system impact assessments focused on understanding how AI systems can affect individuals, groups, and society across the AI system lifecycle. As commonly characterized, it offers a common framework for assessing and addressing AI-related impacts both before and after deployment. It should be understood as a voluntary standard providing guidance rather than a regulatory instrument or binding law; the evidence provided does not specify the standard's detailed clauses, required documentation elements, or its relationship to specific jurisdictional regimes, so those aspects are out of scope for this entry. Practitioners should note that an impact assessment under this standard is distinct from, though potentially complementary to, model risk management activities and legally mandated assessment regimes that may exist under separate frameworks.

Why it matters

As AI systems are deployed into contexts that affect people's access to services, opportunities, and rights, organizations face growing pressure to demonstrate that they have considered the consequences of those systems before and after deployment. ISO/IEC 42005 responds to this need by offering a common, structured approach for assessing how an AI system can affect individuals, groups, and society across its lifecycle. Having a shared framework matters because it gives organizations a consistent vocabulary and process for surfacing potential impacts that might otherwise be identified only after harm has occurred.

An impact assessment conducted under this guidance can support broader AI governance objectives by making the consideration of societal and individual effects a repeatable, documentable activity rather than an ad hoc exercise. This is particularly relevant where organizations must show internal and external stakeholders that impacts were examined systematically. It is important to note, however, that ISO/IEC 42005 is a voluntary standard providing guidance; it is not itself a binding legal requirement, and conducting an assessment under it does not automatically satisfy any legally mandated assessment regime that may exist under separate frameworks.

Professionals should also be careful not to treat an impact assessment as a guarantee that risks have been eliminated. Assessing potential impacts before and after deployment is a measure that helps an organization understand and address AI-related effects; it reduces uncertainty and supports informed decision-making, but it does not remove the underlying risks. The value lies in structured, ongoing consideration of impacts, not in a one-time sign-off.

Who it's relevant to

AI Governance and Policy Specialists
Those responsible for organizational structures and oversight of AI systems may use ISO/IEC 42005 as a reference for embedding structured impact assessment into governance processes. It gives them a recognized, voluntary framework for examining effects on individuals, groups, and society, though it does not replace jurisdiction-specific legal obligations that may apply separately.
Model Risk Managers
Practitioners in model risk management should note that an impact assessment under this standard is distinct from model risk management activities, even where the two are complementary. An ISO/IEC 42005 assessment centers on societal and individual impacts across the lifecycle, which is a different focus from the identification, measurement, monitoring, and control of model risk. The two can inform one another but should not be conflated.
Compliance and Legal Professionals
Legal and compliance teams evaluating AI-related obligations may consider this standard as voluntary guidance rather than binding law. It can support a demonstrable, systematic approach to assessing impacts, but the evidence here does not establish how it maps onto specific regulatory regimes, so its relationship to any mandated assessment requirements should be evaluated separately and not assumed.
Auditors and Assurance Providers
Auditors assessing an organization's AI governance may reference ISO/IEC 42005 as a benchmark for whether impact assessments are conducted in a structured, repeatable manner before and after deployment. Because the detailed clauses and documentation expectations are out of scope for this entry, auditors should consult the standard directly to confirm specific criteria.

Inside Impact Assessment (ISO/IEC 42005)

AI system impact assessment process
ISO/IEC 42005 is an international standard, published by ISO and IEC, that provides guidance on how organizations can conduct assessments of the potential impacts of AI systems on individuals, groups, and society. As a voluntary standard, it offers a structured process rather than legally binding requirements.
Scope and timing of the assessment
The standard typically addresses when in the AI system lifecycle an impact assessment should be performed and revisited, and how to define the boundaries of what is being assessed. It is oriented toward guidance on process, not a mandated single template.
Identification of potential impacts
Guidance commonly covers identifying potential positive and negative impacts of an AI system, including impacts on affected stakeholders. This relates to but is distinct from technical model risk measurement under model risk management guidance such as SR 11-7.
Documentation and records
The standard emphasizes documenting the assessment, its inputs, findings, and any decisions taken, so results can be reviewed and revisited. Documentation supports governance accountability rather than by itself reducing model risk.
Relationship to AI governance and management systems
Impact assessment under ISO/IEC 42005 is often positioned to support broader AI governance activities, and can complement an AI management system such as the one described in ISO/IEC 42001. The two are related but separate instruments and should not be treated as interchangeable.

Common questions

Answers to the questions practitioners most commonly ask about Impact Assessment (ISO/IEC 42005).

Is an AI impact assessment under ISO/IEC 42005 the same thing as a data protection impact assessment?
No, and treating them as interchangeable is a common error. A data protection impact assessment focuses on risks to personal data and privacy and is often tied to specific data protection law obligations in particular jurisdictions. An AI system impact assessment as addressed by ISO/IEC 42005 is broader in intent, covering potential impacts of an AI system on individuals, groups, and society. The two may overlap where an AI system processes personal data, and organizations sometimes coordinate them, but they are conceptually distinct exercises with different scopes. ISO/IEC 42005 is a voluntary international standard rather than a legal instrument, so it does not by itself satisfy any statutory data protection assessment requirement.
Does completing an ISO/IEC 42005 impact assessment mean the AI system's risks have been eliminated?
No. An impact assessment is a process for identifying, analyzing, and documenting potential impacts of an AI system; it is a measure that supports understanding and managing risk, not one that removes it. The output typically informs decisions and further controls rather than certifying that a system is safe or compliant. Any residual risk generally remains after mitigations are applied, and the assessment itself does not guarantee particular outcomes. Presenting a completed assessment as evidence that risk has been eliminated misrepresents both the purpose of the exercise and the nature of the standard.
When in the AI system lifecycle should an impact assessment be performed?
Impact assessments are commonly initiated early, such as during design or planning, so that identified impacts can inform system decisions before significant resources are committed. Many approaches also treat the assessment as something to revisit at defined points, for example when the system's purpose, data, or deployment context changes materially. The specific timing and triggers depend on how an organization integrates the assessment into its own governance and development processes; the standard describes a process rather than mandating a single fixed schedule.
Who within an organization should be involved in conducting an impact assessment?
Impact assessments typically benefit from input across several functions because the potential impacts of an AI system span technical, legal, ethical, and business dimensions. Contributors often include those with knowledge of the system's design and data, those responsible for governance or compliance, and stakeholders who understand the affected individuals or use context. The appropriate roles and level of involvement depend on the organization's structure and the significance of the system, and organizations generally document who was involved and how responsibilities were allocated.
What kinds of information are commonly documented in an impact assessment?
Documentation commonly covers a description of the AI system and its intended purpose, the context and stakeholders involved, the potential impacts identified, and the analysis of those impacts. It may also record assumptions, the information sources relied on, and the decisions or actions that follow from the assessment. The precise content and format vary with the organization and the system being assessed; the aim is generally to create a traceable record that supports review and can be revisited as circumstances change.
How does an impact assessment relate to an organization's broader AI governance and risk management activities?
An impact assessment is generally one input into wider governance and risk management rather than a standalone activity. Its findings can inform decisions about controls, oversight responsibilities, and whether and how a system proceeds, and they may feed into risk management processes that identify, measure, monitor, and control risks over time. Organizations often connect the assessment to their existing accountability structures and management systems so that identified impacts are tracked and acted upon, though the specific integration depends on how each organization has structured its governance.

Common misconceptions

ISO/IEC 42005 is a legal requirement that organizations must comply with.
As commonly understood, ISO/IEC 42005 is a voluntary international standard issued by ISO and IEC, not binding law. It may inform how an organization meets obligations under separate legal frameworks, but the standard itself does not, on its own, carry the force of regulation in any given jurisdiction.
An AI impact assessment under ISO/IEC 42005 is the same as model validation.
An impact assessment focuses on identifying and documenting potential effects of an AI system on individuals, groups, and society, which is a governance-oriented activity. Model validation, as framed in model risk management guidance, is a distinct technical exercise evaluating whether a model performs as intended. The two can complement each other but should not be conflated.
Completing an impact assessment eliminates the risks posed by an AI system.
An impact assessment is a measure that helps identify and manage potential impacts; it does not eliminate risk. It supports informed decision-making and can reduce residual risk when paired with appropriate controls, but risk typically remains and may need ongoing monitoring.

Best practices

Treat ISO/IEC 42005 as voluntary guidance and map its impact assessment process to whatever binding legal obligations apply in your jurisdiction, rather than assuming the standard alone satisfies regulatory requirements.
Perform the impact assessment early in the AI system lifecycle and revisit it when the system, its context, or affected stakeholders change materially.
Clearly define and document the scope and boundaries of each assessment so that what is and is not being evaluated is transparent to reviewers.
Keep the impact assessment distinct from, but connected to, technical model validation and model risk activities, so governance and model risk functions each retain their separate roles.
Document assessment inputs, identified potential impacts, and decisions taken so the results can be reviewed, audited, and updated over time.
Position the impact assessment within your broader AI governance structures and, where relevant, align it with an AI management system such as ISO/IEC 42001 without treating the two instruments as interchangeable.