ISO/IEC 42005:2025 AI system impact assessment

What it is

ISO/IEC 42005:2025, Information technology, Artificial intelligence, AI system impact assessment, was published in May 2025 by ISO and IEC through JTC 1/SC 42, the same committee that produced ISO/IEC 42001. It is the first international standard dedicated to assessing the impact of AI systems on people.

It gives guidance in two parts. The first is how to set up and run an impact assessment process inside an organisation. The second is what an individual assessment should document. It is written to be used alongside ISO/IEC 42001 and ISO/IEC 23894, and it can be used on its own by organisations that have not adopted a management system. The standard is paid.

Who it applies to

Any organisation that develops, provides or uses AI systems can use it, in any sector and at any size. It is voluntary guidance. Its practical weight comes from ISO/IEC 42001, which requires an AI system impact assessment (clause 6.1.4 and the Annex A controls on assessing impacts), and from laws and policies that require impact assessments of AI, for which it offers a recognised method.

What it requires

As a guidance standard it recommends rather than mandates, but its structure is specific.

The impact assessment process

The standard recommends that an organisation define and document a repeatable process covering the steps below.

• Integration. Connect the impact assessment to existing processes such as risk management, privacy impact assessment, procurement and change management, so it is not a standalone exercise.
• Timing. Decide at which lifecycle stages an assessment happens, typically at inception or acquisition, before deployment and on significant change, and how often it is reviewed.
• Scope. Define which systems and uses are in scope and set the depth of assessment.
• Responsibilities. Assign who performs, reviews and approves assessments.
• Thresholds. Set thresholds for sensitive uses, restricted uses and impact scales, so the organisation knows in advance when a fuller assessment or escalation is needed.
• Performing and analysing. Carry out the assessment, analyse the results and decide on actions.
• Recording and reporting. Keep records and report results to the right people.
• Approval, monitoring and review. Approve the assessment, monitor the system in use and repeat the assessment as things change.

What an assessment documents

The standard sets out the elements an assessment should record.

• the scope of the assessment and the AI system’s description, purpose and intended uses
• information about the data the system uses, including its provenance and quality
• information about the algorithms and models, and the deployment environment
• the relevant interested parties, including people affected who are not users
• the actual and reasonably foreseeable impacts, both benefits and harms, on individuals, groups and society
• potential failures and reasonably foreseeable misuse
• the measures to address harms and enhance benefits.

Harms to consider include effects on fundamental rights, fairness, privacy, safety, wellbeing, the environment and access to services. The standard asks for attention to foreseeable misuse, not only intended use.

Using it in practice

The hardest part is usually the process rather than any single assessment. An organisation first needs a complete list of its AI systems, because an impact assessment cannot be run on a system nobody knows about. It then needs thresholds agreed in advance, so a chatbot that answers product questions gets a light assessment while a system that screens job applicants or informs credit decisions gets a full one. Assessments should be tied to change management, so a new model version, a new data source or a new group of affected people triggers a fresh look. Keeping each assessment with the version of the system it described makes later review and audit far easier.

Key dates

ISO/IEC 42005 was published in May 2025 as its first edition and is current.

How it relates to other frameworks

ISO/IEC 42005 fills in the detail behind ISO/IEC 42001’s requirement for an AI system impact assessment. It complements ISO/IEC 23894, which covers risk to the organisation, by looking at consequences for the people and communities a system touches. Together they let an organisation run one coordinated assessment cycle that meets the management system’s needs.

Outside the ISO family, the Council of Europe’s HUDERIA methodology offers a human rights, democracy and rule of law lens on the same question, with its own scoring approach. The EU AI Act requires some deployers of high-risk systems to carry out a fundamental rights impact assessment, and several public-sector frameworks around the world require algorithmic or AI impact assessments. A process designed with ISO/IEC 42005 can be shaped to produce what each of those asks for, though each instrument’s own text remains the test.