FINAL DRAFT

International
Standard

ISO/IEC FDIS
42005
ISO/IEC JTC 1/SC 42
Information technology — Artificial
intelligence — AI system impact Secretariat: ANSI

assessment Voting begins on:

2025-02-19
iTeh StandardsVoting terminates on:
2025-04-16
(https://standards.iteh.ai)
Document Preview
ISO/IEC FDIS 42005
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005

RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,

WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR­TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN­DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.

Reference number
ISO/IEC FDIS 42005:2025(en) © ISO/IEC 2025
 ISO/IEC FDIS 42005:2025(en)

iTeh Standards
(https://standards.iteh.ai)
Document Preview
ISO/IEC FDIS 42005
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005

COPYRIGHT PROTECTED DOCUMENT

© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland


© ISO/IEC 2025 – All rights reserved
ii
 ISO/IEC FDIS 42005:2025(en)

Contents Page

Foreword....................................................................................................................................................................................................................................................... v
Introduction............................................................................................................................................................................................................................................ vi
1 Scope.............................................................................................................................................................................................................................................. 1
2 Normative references.................................................................................................................................................................................................. 1
3 Terms and definitions................................................................................................................................................................................................. 1
4 Abbreviated terms.......................................................................................................................................................................................................... 2
5 Developing and implementing an AI system impact assessment process........................................................... 3
5.1 General.........................................................................................................................................................................................................................3
5.2 Documenting the process...........................................................................................................................................................................3
5.3 Integration with other organizational management processes...............................................................................4
5.4 Timing of AI system impact assessment....................................................................................................................................... 4
5.5 Scope of the AI system impact assessment................................................................................................................................. 5
5.6 Allocating responsibilities.........................................................................................................................................................................5
5.7 Establishing thresholds for sensitive uses, restricted uses and impact scales..........................................6
5.8 Performing the AI system impact assessment......................................................................................................................... 7
5.9 Analysing the results of the AI system impact assessment..........................................................................................7
5.10 Recording and reporting.............................................................................................................................................................................7
5.11 Approval process................................................................................................................................................................................................ 8
5.12 Monitoring and review.................................................................................................................................................................................. 9
6 Documenting the AI system impact assessment............................................................................................................................. 9
6.1 iTeh Standards
General.........................................................................................................................................................................................................................9
6.2 Scope of the AI system impact assessment................................................................................................................................. 9
6.3 (https://standards.iteh.ai)
AI system information................................................................................................................................................................................10
6.3.1 AI system description...............................................................................................................................................................10
Document Preview
6.3.2 AI system functionalities and capabilities.............................................................................................................10
6.3.3 AI system purpose.......................................................................................................................................................................10
6.3.4 Intended uses...................................................................................................................................................................................10
6.3.5 Unintended uses............................................................................................................................................................................
ISO/IEC FDIS 42005 11
6.4 Data information and quality . . .............................................................................................................................................................
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005 11
6.4.1 General...................................................................................................................................................................................................11
6.4.2 Data information...........................................................................................................................................................................11
6.4.3 Data quality documentation.............................................................................................................................................. 12
6.5 Algorithm and model information.................................................................................................................................................. 12
6.5.1 General.................................................................................................................................................................................................. 12
6.5.2 Information on algorithms used by the organization................................................................................. 12
6.5.3 Information on algorithm development.................................................................................................................. 13
6.5.4 Information on models used in an AI system..................................................................................................... 13
6.5.5 Information on model development............................................................................................................................. 14
6.6 Deployment environment........................................................................................................................................................................ 14
6.6.1 Geographical area and languages.................................................................................................................................. 14
6.6.2 Deployment environment complexity and constraints.............................................................................. 14
6.7 Relevant interested parties................................................................................................................................................................... 15
6.7.1 General.................................................................................................................................................................................................. 15
6.7.2 Directly affected interested parties........................................................................................................................... 15
6.7.3 Other relevant interested parties................................................................................................................................. 15
6.8 Actual and reasonably foreseeable impacts............................................................................................................................16
6.8.1 General...................................................................................................................................................................................................16
6.8.2 Benefits and harms.....................................................................................................................................................................16
6.8.3 AI system failures and reasonably foreseeable misuse..............................................................................19
6.9 Measures to address harms and benefits................................................................................................................................. 20
Annex A (informative) Guidance for use with ISO/IEC 42001........................................................................................................... 21
Annex B (informative) Guidance for use with ISO/IEC 23894........................................................................................................... 23


© ISO/IEC 2025 – All rights reserved
iii
 ISO/IEC FDIS 42005:2025(en)

Annex C (informative) Harms and benefits taxonomy.............................................................................................................................. 25

Annex D (informative) Aligning AI system impact assessment with other assessments.................................... 27
Annex E (informative) Example of an AI system impact assessment template.............................................................. 31
Bibliography.......................................................................................................................................................................................................................................... 38

iTeh Standards
(https://standards.iteh.ai)
Document Preview
ISO/IEC FDIS 42005
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005


© ISO/IEC 2025 – All rights reserved
iv
 ISO/IEC FDIS 42005:2025(en)

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
iTeh Standards
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
(https://standards.iteh.ai)
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Document Preview
Subcommittee SC 42, Artificial intelligence.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies ISO/IECcan
FDISbe42005
found at www.iso.org/members.html and
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005
www.iec.ch/national-committees.


© ISO/IEC 2025 – All rights reserved
v
 ISO/IEC FDIS 42005:2025(en)

Introduction
The growing application of systems, products, services and components of such that incorporate some form
of artificial intelligence (AI) has led to a growing concern about how AI systems can potentially impact
all levels of society. AI brings with it the promise of great benefits: automation of difficult or dangerous
jobs, faster and more accurate analysis of large sets of data, advances in healthcare etc. However, there are
concerns about reasonably foreseeable negative effects of AI systems, including potentially harmful, unfair
or discriminatory outcomes, environmental harm and unwanted reductions in workforce.
The development and use of seemingly benign AI systems can have the potential to significantly impact
(both positively and negatively) individuals, groups of individuals and the society as a whole. To foster
transparency and trustworthiness of systems using AI technologies, an organization developing and using
these technologies can take actions to assure affected interested parties that these impacts have been
appropriately considered. AI system impact assessments play an important role in the broader ecosystem
of governance, risk and conformity assessment activities, which together can create a system of trust and
accountability.
ISO/IEC 38507, ISO/IEC 23894 and ISO/IEC 42001 all form important pieces of this ecosystem, for governance,
risk and conformity assessment (via a management system) respectively. Each of these highlights the need
for consideration of impacts to individuals and societies. A governing body can understand these impacts
to ensure that the development and use of AI systems align to company values and goals. An organization
performing risk management activities can understand reasonably foreseeable impacts to individuals and
societies to appropriately incorporate into their overall organizational risk assessment. An organization
developing or using AI systems can incorporate understanding and documentation about these impacts into
its management system to ensure that the AI systems in question meet expectations of relevant interested
iTeh Standards
parties, as well as internal and external requirements.
The act of performing AI system impact assessments and utilizing their documented outcomes are integral
(https://standards.iteh.ai)
to activities at all organizational levels to produce AI systems that are trustworthy and transparent. To
this end, this document provides guidance for an organization on how to both implement a process for
Document Preview
completing such assessments and promote a common understanding of the components necessary to
produce an effective assessment.

ISO/IEC FDIS 42005

https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005


© ISO/IEC 2025 – All rights reserved
vi
FINAL DRAFT International Standard ISO/IEC FDIS 42005:2025(en)

Information technology — Artificial intelligence — AI system

impact assessment

1 Scope
This document provides guidance for organizations performing AI system impact assessments for
individuals and societies that can be affected by an AI system and its foreseeable applications. It includes
considerations for how and when to perform such assessments and at what stages of the AI system life cycle,
as well as guidance for AI system impact assessment documentation.
Additionally, this guidance includes how this AI system impact assessment process can be integrated into an
organization’s AI risk management and AI management system.
This document is intended for use by organizations developing, providing or using AI systems. This
document is applicable to any organization, regardless of size, type and nature.

2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
iTeh Standards
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.

terminology
(https://standards.iteh.ai)
ISO/IEC 22989, Information technology — Artificial intelligence — Artificial intelligence concepts and

Document
ISO/IEC 23053, Framework for Artificial Preview
Intelligence (AI) Systems Using Machine Learning (ML)

ISO/IEC FDIS 42005

3 Terms and definitions
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005
For the purposes of this document, the terms and definitions given in ISO/IEC 22989, ISO/IEC 23053 and the
following apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://​w ww​.iso​.org/​obp
— IEC Electropedia: available at https://​w ww​.electropedia​.org/​
3.1
AI system impact assessment
formal, documented process by which the impacts to individuals, groups of individuals and societies are
considered by an organization developing, providing, or using products or services utilizing artificial
intelligence
3.2
intended use
use for which an AI system is designed
3.3
unintended use
use for which an AI system is not designed


© ISO/IEC 2025 – All rights reserved
1
 ISO/IEC FDIS 42005:2025(en)

3.4
intended users
groups of people or information systems for which an AI system is designed
[SOURCE: ISO 20282-1:2006, 3.12, modified — “people” has been replaced with “people or information
systems” and “a product” has been replaced with “an AI system”.]
3.5
interested party
stakeholder
person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity
[SOURCE: ISO/IEC 42001:2023, 3.2]
3.6
reasonably foreseeable misuse
use of an AI system in a way not intended by the AI system developer or provider, but which can result from
readily predictable behaviour of intended users
Note 1 to entry: Readily predictable human behaviour includes the behaviour of all types of users, e.g. the elderly,
children and persons with disabilities. For more information, see ISO 10377.

Note 2 to entry: In the context of consumer safety, the term “reasonably foreseeable use” is increasingly used as a
synonym for “intended use”, and “unintended use” as a synonym for “reasonably foreseeable misuse.”

Note 3 to entry: The specific definitions can vary somewhat, depending on the specific application area of the standard
or regulation.

iTeh Standards
[SOURCE: ISO/IEC Guide 51:2014, 3.7, modified — “a product or system” has been replaced with “an AI
system”, and “supplier” has been replaced with “AI system developer or provider”.]
3.7 (https://standards.iteh.ai)
restricted use
Document
use of an AI system that is constrained Preview
by laws, organizational policies or contractual agreements
3.8
sensitive use ISO/IEC FDIS 42005
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005
use of an AI system that can have a significant adverse impact on individuals, group of individuals or societies
3.9
top management
person or group of people who directs and controls an organization at the highest level
Note 1 to entry: Top management has the power to delegate authority and provide resources within the organization.

Note 2 to entry: If the scope of the management system covers only part of an organization, then top management
refers to those who direct and control that part of the organization.

[SOURCE: ISO/IEC 42001:2023, 3.3]

4 Abbreviated terms

AI artificial intelligence

BIA business impact assessment

EIA environmental impact assessment

FIA financial impact assessment

HRIA human rights impact assessment


© ISO/IEC 2025 – All rights reserved
2
 ISO/IEC FDIS 42005:2025(en)

IT information technology

ML machine learning

PIA privacy impact assessment

PII personally identifiable information

SIA security impact assessmen

5 Developing and implementing an AI system impact assessment process

5.1 General

5.1.1 The organization should have a structured and consistent approach for performing and documenting
AI system impact assessments. The process used can vary depending on a range of factors.

5.1.2 Internal factors include:

a) organizational context, governance, objectives, policies and procedures;

b) contractual obligations;
c) intended use of the Al system to be developed or used;
d) risk appetite. iTeh Standards
(https://standards.iteh.ai)
5.1.3 External factors include:

a) applicable legal requirements, including prohibited uses of AI systems;

Document Preview
b) policies, guidelines and decisions from regulators that have an impact on the interpretation or
enforcement of legal requirements in the development and use of Al systems;
ISO/IEC FDIS 42005
c) incentives or consequences associated with the intended use of Al systems.
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005
d) culture, traditions, values, norms and ethics with respect to development and use of AI systems;
e) competitive landscape and trends for new products and services using Al systems;

5.1.4 Clause 5 details possible elements of an AI system impact assessment process that the organization
can consider when implementing such a process.

5.2 Documenting the process

The organization should document the process for completing AI system impact assessments. Such
documentation should be kept up to date and made available, where appropriate, to relevant interested
parties. Documentation of the process should include information on the topics in Clause 5. The intended
results of the process documentation can vary depending on the organization’s needs and the type of the AI
system, and can include, for example:
a) documented procedural guidance;
b) AI system impact alignment guide or template (refer to Annex D) or for a standalone template (see
Annex E);
c) use cases for awareness-raising and training;
d) input in various management reviews in the related AI management system;


© ISO/IEC 2025 – All rights reserved
3
 ISO/IEC FDIS 42005:2025(en)

e) completed AI system impact assessments and other artefacts from the assessment process.
Documentation should be maintained throughout the AI system impact assessment process within the data
retention policies of the organization and its legal obligations related to data retention, i.e. at the stages of
design, redesign, deployment and evaluation.

5.3 Integration with other organizational management processes

The organization should document how the AI system impact assessment is integrated with other
organizational processes. This can include considerations such as:
a) how the organization integrates the AI system impact assessment with organizational risk assessment;
b) how the organization integrates the AI system impact assessment with other types of impact
assessments;
c) which organizational governance, risk and compliance processes are in place or planned for the
treatment of reasonably foreseeable impacts.
NOTE Annexes A, B and D provide additional information.

5.4 Timing of AI system impact assessment

5.4.1 As part of establishing the AI system impact assessment process, the organization should determine
and define when such assessments should be performed and to what level, or when a previous AI system
impact assessment can be reused, repurposed or revised, and to what extent. Determining the timing of the
iTeh Standards
AI system impact assessments can be impacted by factors such as, but not limited to:

a)
b)
(https://standards.iteh.ai)
applicable legal requirements;
contractual and professional obligations and duties;
c) Document
internal structures, policies, processes, Preview
procedures and resources, including technology;
d) risk level of the AI system (the organization can consider ISO/IEC 23894:2023, 6.3.4 for additional
guidance);
ISO/IEC FDIS 42005
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005
e) expectations of relevant interested parties, including customers;
f) internal AI system life cycle processes;
For additional guidance on the timing of AI system impact assessments and how they can be connected or
aligned with other impact assessments conducted by the organisation, see Annex D.

5.4.2 The organization should consider reassessment when changes arise in factors such as, but not
limited to:

a) change in intended use of the AI system, including changes to the users of the AI system;
b) change in customer expectations;
c) change in the AI system itself, including changes to:
1) the data used;
2) the complexity or type of the AI system;
3) the performance of the AI system;
d) changes in the operational environment of the AI system;


© ISO/IEC 2025 – All rights reserved
4
 ISO/IEC FDIS 42005:2025(en)

e) change in context surrounding the AI system, including changes to:

1) the applicable legal requirements;
2) contractual obligations;
3) internal policies;
4) the relevant interested parties of the AI system;
5) the locations and sectors in which the organization operates or anticipates operating.
AI risk assessments and AI system impact assessments should be conducted prior to implementing the
change triggering reassessment.

5.4.3 Timing considerations can include:

a) how often AI system impact assessments are performed;

b) at what stage of the AI system life cycle the AI system impact assessment is performed;
c) how frequently the AI system impact assessment is updated;
d) under what circumstances a new AI system impact assessment or an update is needed;
e) what other impact assessments are linked to the AI system impact assessment.

5.4.4 The organization should consider whether it uses tools for triaging when an AI system impact
iTeh Standards
assessment is required. For example, if the organization determines that AI system impact assessments are
only to be done on “high-risk” AI systems, they should document as part of the process what constitutes a
(https://standards.iteh.ai)
“high-risk” AI system and what triggers the need for an impact assessment. A triaging process can require a
briefer version of the AI system impact assessment to determine if the AI system is high-risk and requires a
Document Preview
full AI system impact assessment.

5.5 Scope of the AI system impact assessment

ISO/IEC FDIS 42005
The organization should define the scope of the AI system impact assessment, including the applicability
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005
and the boundaries of the AI system impact assessments considering the internal and external factors
provided in 5.1, the expectations of relevant interested parties and the reasonably foreseeable impacts on
individuals, groups of individuals or societies. The scope of an AI system impact assessment can include, but
is not limited to:
a) the entire AI system or a component of the AI system that provides functionalities explicitly useable by
users (e.g. when a change is made to one or more components of the AI system);
b) a description of the role of the organization within the AI ecosystem (e.g. data provider, model provider,
service provider or product provider).
If a system is composed of interconnected AI systems, the organization should consider whether to perform
a single AI system impact assessment.
NOTE Changes to an AI system component can have implications to the overall AI system impact on various
interested parties.

5.6 Allocating responsibilities

The organization should ensure that the responsibilities for the AI system impact assignment are assigned
and communicated within the organization. The relevant responsibilities depend on multiple factors,
including the nature of the AI system impact assessment, its scope and its extent, the existence of a previous
assessment, and can include responsibilities for:
a) establishing the scope of the assessment;


© ISO/IEC 2025 – All rights reserved
5
 ISO/IEC FDIS 42005:2025(en)

b) ensuring the allocation of appropriate resources;

c) ensuring the availability of documented information:
d) liaising with the relevant interested parties that can contribute to the assessment (e.g. groups and
personnel responsible for research and development, marketing and sales, security and operations,
legal personnel, labour representatives and other relevant interested parties);
e) reporting and communication of the results or any relevant information to other organizational process
or functions;
f) establishing approvals process and escalations;
g) ensuring the availability of the AI system impact assessment to relevant management reviews within
the AI management system and the organization;
The assignment of responsibilities should consider the required experience and competency, the relevance
of the role and the necessary access to information.
The organization should ensure that the assignment of responsibilities takes into account the relevant
need for a multidisciplinary approach to consider impacts that can be reasonably foreseen and addressed
throughout the AI system’s life cycle.
NOTE Relevant disciplines can include engineering, health and safety, human rights, ethics and social sciences
such as anthropology, sociology and psychology.

5.7 Establishing thresholds for sensitive uses, restricted uses and impact scales
iTeh Standards
A critical part of the AI system impact assessments processes is ensuring that thresholds, particularly
around AI system use, are documented. The organization should define those thresholds, based on the
(https://standards.iteh.ai)
context in which they operate. This can include considerations such as:
a)
Document Preview
applicable legal requirements;
b) expectations of relevant interested parties;
c) state of the art; ISO/IEC FDIS 42005
https://standards.iteh.ai/catalog/standards/iso/8c12e0d0-73ac-4df2-adb8-251cf989bb23/iso-iec-fdis-42005
d) benefits of the AI system;
e) cultural, labour and societal norms;
f) applicable AI ethical frameworks.
Depending on the types and amounts of thresholds, the organization can implement additional processes,
including reviews and approvals. For example, the organization can decide that certain uses or reasonably
foreseeable misuses are sensitive or prohibited by organizational policy. Legal or other external requirements
can further determine the sensitivity of uses or reasonably foreseeable misuses of an AI system. If an AI
system impact assessment indicates that its planned use falls under a “sensitive” or a “restricted” category,
the organization should document what the next steps are as part of the overall process.
EXAMPLE 1 An example of a sensitive use case can be an AI systems designed to automate lending decisions, as
such systems can have significant adverse financial impacts on individuals.

EXAMPLE 2 If a sensitive or restricted use is identified, then such uses can be escalated to management (including
approvals). Consider an AI system which heavily impacts rights, particularly those of children, and with adverse
impacts that cannot be mitigated by technical improvements. Such issues can be escalated to decide whether to review
the development of this AI system due to adverse impact.

The organization should also consider how overall impact scales are determined and reasonably foreseeable
impacts are calculated. The results of an AI system impact assessment can indicate, for example, that
intended uses for an AI system are not sensitive but can affect a large population of users, and that should


© ISO/IEC 2025 – All rights reserved
6