What is an AI Impact Assessment and How it Supports ISO/IEC 42001

As organisations introduce AI into more areas of their work, it becomes increasingly important to understand not only whether a system functions as intended, but how its use could affect the people around it. 

An AI impact assessment gives an organisation a structured way to examine those effects. It can help identify who may be affected and what consequences could arise, while also establishing what oversight should remain in place once the system is operational. 

For organisations working with ISO/IEC 42001, impact assessment can support the wider Artificial Intelligence Management System, or AIMS. The assessment focuses on a particular AI system or use case, while the AIMS provides the organisational structure needed to make sure its findings influence real decisions.

An AI impact assessment is a structured process used to identify and document the effects an AI system may have on the people who use it or are affected by its outputs. 

Some of those effects may be intended. An organisation introducing an AI assistant, for example, may expect it to reduce administrative work and help employees respond more quickly. 

Other effects may be less obvious. The system could provide unreliable advice or handle personal information in ways the organisation hadn’t anticipated. It may also change employee responsibilities or leave customers with no practical way to challenge an incorrect output. 

The purpose of the assessment isn’t to predict every possible outcome with certainty. AI systems operate within changing environments, so some uncertainty will always remain. Instead, the assessment gives the organisation a more informed basis for deciding whether the system should be used and what controls it needs. It also creates a starting point for reviewing its effects over time. 

Impact assessment and risk assessment are closely connected, but they aren’t always identical.

A risk assessment generally considers uncertainty in relation to the organisation’s objectives. It may examine what could go wrong, how likely that outcome is and whether the organisation has done enough to reduce the risk. 

An impact assessment places greater emphasis on the effects created by the system, particularly for the people who may experience them. 

Consider an organisation using AI to help screen job applications. A conventional risk assessment might examine whether the system could produce inaccurate recommendations or expose confidential information. It may also consider the operational consequences if the tool becomes unavailable. 

An impact assessment would look more closely at the experience of the applicants. It would consider whether some groups could receive less favourable outcomes, how much influence the system has over the final decision and whether an applicant has a realistic way to question or correct the result. 

The two exercises should inform one another. However, the distinction is useful because a system can create serious consequences for other people even when the immediate business risk appears manageable.

ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System. It gives organisations a coordinated structure for governing AI by connecting their policies with the people responsible for putting them into practice. 

The management system operates across the organisation, but many governance decisions still need to be made at the level of an individual AI system. 

An organisation may have an overall AI policy, for example, but it still needs to understand the consequences associated with each use case. A recruitment tool will raise different concerns from an internal productivity assistant, and the level of oversight should reflect those differences. 

An impact assessment helps connect the organisation-wide management system with those specific systems. 

Within an AIMS, the organisation can establish when an assessment should be carried out and who is responsible for completing it. It can also define who has the authority to approve the proposed use, along with how the findings should affect later decisions. 

That structure is important because completing the assessment isn’t the final objective. Its findings should influence what the organisation does next. 

A concern about how the system treats certain users may lead to additional testing. Weak human oversight could require changes to the approval process, while uncertainty about the reliability of the system may justify limits on how its outputs can be used. 

In some cases, the organisation may conclude that the proposed use creates consequences that can’t be justified. 

The same principle applies after deployment. An assessment completed during planning may no longer reflect how the system operates several months later. A software update could alter its behaviour, or employees may begin relying on its outputs more heavily than originally expected. 

The organisation therefore needs to decide what evidence it will monitor and what kinds of change should trigger a new assessment. 

This fits naturally with the continual improvement approach behind ISO/IEC 42001. Impact assessment can help the organisation identify possible effects during planning and then revisit its assumptions once the system is in use. 

It should also connect with the organisation’s existing AI governance processes. The AI inventory can provide information about the system and its owner, while risk-management activities can address concerns identified through the assessment. When these processes work together, impact assessment becomes part of normal AI governance rather than a document completed only for approval purposes.

The depth of an assessment should depend on the system and the context in which it operates. A low-impact productivity tool shouldn’t necessarily receive the same level of analysis as a system that could influence whether someone gets a job or gains access to an important service. 

The organisation should begin by defining what the system is intended to do and what role it will play in the wider process. 

It needs to understand who will use the system, but that’s only part of the picture. The assessment should also identify anyone who may be affected by its outputs, including people who may never interact with the system directly. From there, the organisation can examine how much influence the AI will have over the final decision. 

The assessment should consider whether the system could affect some people differently from others. The relevant concerns will depend on the use case. For one system, the main issue may be accessibility. For another, it may be the handling of personal information or the lack of a realistic route for challenging a result. 

Human oversight also needs more attention than a simple statement that a person remains involved. 

Oversight may be ineffective if the reviewer lacks the time needed to question the system properly. The same is true when the reviewer has the authority to reject an output on paper, but workplace expectations encourage them to accept it by default. 

The organisation should therefore be clear about what the reviewer is expected to do and what information they’ll receive. It should also decide whether the AI output is genuinely advisory or whether it has effectively become the starting point for the final decision. 

The assessment should consider what happens if the system fails or begins producing unexpected outputs. Changes introduced through updates also need attention, especially when the organisation has limited visibility into how the underlying system has been modified. 

Monitoring arrangements should be defined while the assessment is being completed, rather than added only after a problem occurs. 

Several people may need to contribute. Technical specialists can explain how the system works, while the employees using it may have a better understanding of how it will behave in practice. Other expertise may be needed where the use case raises questions about privacy or regulatory obligations. 

Not every assessment requires a large committee, but it should include enough perspectives to challenge the assumptions behind the proposed use. 

Responsibility must still remain clear. Involving several teams doesn’t remove the need for somebody to approve the assessment and make sure the agreed controls are actually introduced. 

The final decision and its reasoning should be documented clearly enough that it can be reviewed later. Without that follow-through, the assessment can become another record of concerns that doesn’t meaningfully change how the AI system is managed. 

AI impact assessment gives organisations a structured way to examine the consequences associated with a particular AI system. 

Within ISO/IEC 42001, it can connect the broader management system with practical decisions about individual use cases. That helps the organisation assign responsibility more clearly and maintain oversight once the system is operating. 

For professionals, impact assessment also provides a useful example of what AI governance work looks like in practice. It requires an understanding of the technology, but the work extends far beyond technical performance. Practitioners also need to understand the affected people and turn what they learn into documented governance decisions. 

Safeshield’s ISO/IEC 42001 Hub brings together guidance on Artificial Intelligence Management Systems with practical resources for organisations and professionals. Access the Hub to continue building your understanding of ISO/IEC 42001 and find the content or training pathway most relevant to your goals.