The gap 42005 fills
ISO/IEC 42001, the AI management system standard, requires organisations to assess the potential consequences of their AI systems for individuals and society. It does not say much about how. ISO/IEC 42005, published in 2025, is guidance on exactly that: when to carry out an AI system impact assessment, what it should cover, and how to document it so it can feed into risk management.
It is a guidance standard, so there is no certification against 42005 itself. Its value is in giving teams a defensible structure instead of an improvised one.
Impact is not the same as risk to the organisation
A risk register usually asks what could go wrong for the organisation: fines, outages, reputational damage. An impact assessment asks what the system could do to the people affected by it, including people who never use it directly. A loan applicant who is declined, a candidate who is filtered out and a resident whose case is deprioritised are all affected parties. Their perspective is the point of the exercise.
How we approach it in practice
- Start from a clear system description: purpose, users, affected people, data, level of autonomy and deployment context.
- Include foreseeable misuse and use in contexts the team did not design for, not only the intended use.
- Record benefits as well as harms. An assessment that only lists harms gives decision makers nothing to weigh them against.
- Name the trigger events that require the assessment to be revisited: a new model, a new user group, a new market, a significant incident.
- Link each significant impact to a control and an owner in the risk register, so the assessment changes what happens.
Where it fits with other assessments
Teams in the UK and EU may already run a data protection impact assessment, and some will need a fundamental rights impact assessment under the EU AI Act. These overlap. The practical approach is one shared system description and evidence base, with each assessment drawing on it, rather than three separate documents that drift apart.
If you need a first impact assessment for a system that is already in use, the AI Opportunity and Governance Sprint can get you to a working draft and a review plan.