With the increasing deployment of artificial intelligence (AI) systems in key public and business processes, issues related to ethics, transparency, the protection of fundamental rights and risk management are becoming increasingly significant. In this context, ISO/IEC 42005:2025 has emerged as an important international standard that provides guidance for assessing the impact of AI systems on individuals, organisations and society.
The standard is part of the ISO/IEC 42xxx family, developed specifically for the governance, risk management and impact of artificial intelligence, and complements the system-based approach established by ISO/IEC 42001 for AI management systems.
 
What is ISO/IEC 42005:2025
ISO/IEC 42005 provides guidance and methodological principles for conducting AI system impact assessments — a structured assessment of the potential and actual impacts arising from the use of AI systems throughout their lifecycle.
Unlike ISO/IEC 42001, which focuses on establishing and maintaining an AI management system at organisational level, ISO/IEC 42005 focuses on:

• the consequences of the operation and use of specific AI systems;
• their effects on individuals and society;
• the early identification and addressing of negative impacts already at the design and deployment stages.

 
Main objectives of the standard
The primary objective of ISO/IEC 42005 is to support organisations in:

• identifying risks and impacts associated with the use of AI;
• preventing or mitigating negative effects on fundamental human rights and freedoms;
• integrating ethical principles into the design and operation of AI systems;
• supporting informed managerial decision-making;
• enhancing transparency and accountability in the use of AI technologies.

 
What the impact assessment covers
ISO/IEC 42005 provides guidance for a structured and systematic approach, which includes the following key elements.
1. Defining scope and context

• the purpose and intended use of the AI system;
• the manner of use and the operational environment;
• identification of relevant interested and potentially affected parties;
• identification of vulnerable groups.

2. Identification of impacts
The standard draws attention to a wide range of potential impacts, including:

• impacts on fundamental rights (e.g. non-discrimination, privacy, access to services);
• ethical risks—bias, non-transparent or difficult-to-understand decisions, automated decision-making;
• social and economic effects;
• risks to information security and data protection;
• environmental impacts, where relevant to the specific AI system.

3. Assessment of significance and risk
ISO/IEC 42005 recommends a systematic analysis of the likelihood of negative effects occurring, taking into account the real-world context of use of the AI system, the frequency of its application and the degree of automation of decision-making.
The assessment considers:

• the severity and scale of the impact;
• the number and characteristics of affected individuals;
• the sensitivity of the data processed;
• short-term, long-term and cumulative effects, including those arising from the combined use of multiple AI systems.

This multi-dimensional approach supports the adoption of proportionate and effective risk management measures and promotes the responsible use of AI.
The impact assessment should be closely integrated with AI risk management processes within the AI management system in accordance with ISO/IEC 42001. While ISO/IEC 42001 establishes the framework for managing risks at organisational level, ISO/IEC 42005 provides tools for an in-depth analysis of the impacts of individual AI systems. The results of the impact assessment can be used as input for determining acceptable risk levels and planning control and corrective measures.
4. Management and mitigation measures
The standard encourages the application of:

• technical and organisational controls;
• human oversight mechanisms (human-in-the-loop);
• transparency and awareness policies;
• corrective and preventive actions;
• periodic review and updating of the assessment.

5. Documentation and accountability
ISO/IEC 42005 places strong emphasis on traceability and documentation of the impact assessment process. The guidance covers documentation of:

• the defined scope and context;
• identified impacts;
• decisions taken and their rationale;
• implemented risk management measures.

This supports transparency, internal control, management reviews and readiness for regulatory inspections, audits and external assessments.
 
Organisations to which the standard is applicable
ISO/IEC 42005 is applicable to organisations that:

• develop AI systems;
• deploy or use AI in business or public processes;
• operate or manage high-risk AI systems.

The standard is particularly relevant for sectors such as:

• finance and insurance;
• healthcare;
• public administration;
• critical infrastructure;
• human resources, education and social services.

 
Relationship with regulations and other standards
ISO/IEC 42005 can support organisations in preparing for compliance with:

• the EU Artificial Intelligence Act (AI Act), particularly for high-risk AI systems;
• GDPR and data protection impact assessments (DPIAs);
• ISO/IEC 42001 – AI management systems;
• ISO/IEC 23894 – AI risk management;
• ISO/IEC 27001 and ISO/IEC 27701 – information security and privacy information management.

 
Benefits of applying ISO/IEC 42005
Implementing the standard offers a range of strategic and operational benefits, including:

• improved management of legal, ethical and reputational risks;
• reduced likelihood of adverse regulatory consequences through better awareness and documentation;
• increased trust among clients, partners and society;
• demonstration of responsible and sustainable use of AI;
• better integration between technology, governance and organisational values.

 
ISO/IEC 42005 provides a practical framework for organisations that use or plan to use artificial intelligence in a responsible and sustainable manner. Through systematic and documented impact assessment, the standard supports risk management, informed decision-making and improved readiness for regulatory requirements, while contributing to greater transparency, trust and ethical approaches in digital transformation processes.