Frameworks / ISO_42005
ISO/IEC 42005:2025 — AI system impact assessment
ISO/IEC · International · effective 2025-05-28 · ISO_42005
Guidance standard — no certification scheme, no external audit exists against it. Seeded here at the process-clause (5.x) and documentation-clause (6) level only, from ISO/IEC's own freely published table of contents; the standard's operative clause text is copyrighted and not reproduced.
12 controls, mapped to the evidence that satisfies each
Every control links to the dimension whose evidence would satisfy it. That mapping is the working link between an obligation written in law or a standard and a document somebody has to produce. Each row has its own address: link to a single control.
| Control | Title | Requirement | Satisfied by |
|---|---|---|---|
| 5.10 | Recording and reporting | The assessment's inputs, findings and conclusions are recorded in a form that can be reported to whoever needs it — internally, or to an affected party or regulator where applicable. | D1 |
| Clause 6 | Documenting the AI system impact assessment | A completed assessment document captures, at minimum: what the system does and its intended/unintended uses; the data and its quality; algorithm/model information; the deployment environment; who is affected; and the actual and reasonably foreseeable benefits and harms, with measures to address them. | D1 |
| 5.5 | Scope of the AI system impact assessment | The organization defines what a given impact assessment covers — which system, which use, which population — before performing it. | D2 |
| 5.8 | Performing the AI system impact assessment | The assessment is carried out against the defined scope and thresholds, producing the analysis the later clauses document. | D2 |
| 5.9 | Analysing the results of the AI system impact assessment | Findings from performing the assessment are analysed — weighed for severity and likelihood — before being recorded or acted on. | D2 |
| 5.7 | Establishing thresholds for sensitive uses, restricted uses and impact scales | The organization sets criteria for what counts as a sensitive or restricted use and how impact severity is scaled, so whether a use needs deeper scrutiny is judged against a stated threshold rather than case by case. | D4 |
| 5.11 | Approval process | A completed impact assessment is reviewed and signed off through a defined approval step before the system it covers proceeds, rather than filed without sign-off. | D6 |
| 5.12 | Monitoring and review | The impact assessment is revisited on a schedule or trigger after initial approval, so a conclusion reached at one point in the system's life does not stand unexamined indefinitely. | D6 |
| 5.2 | Documenting the process | The organization's AI system impact assessment process itself — not each individual assessment — is written down: what triggers it, who runs it, and what a completed assessment must contain. | D6 |
| 5.3 | Integration with other organizational management processes | The impact-assessment process is connected to the organization's other management processes (risk management, an AI management system) rather than run as an isolated, one-off exercise. | D6 |
| 5.4 | Timing of AI system impact assessment | The organization defines when an impact assessment is carried out relative to the AI system's life cycle — before deployment, after a material change, or on a recurring schedule. | D6 |
| 5.6 | Allocating responsibilities | Roles and responsibilities for conducting, reviewing and approving an impact assessment are assigned to named people or functions. | D6 |
What this mapping is, and what it is not
It is a reading of a published instrument, with each control cited to its source, mapped to the kind of evidence that would satisfy it. It is not legal advice, not a certification, and not a statement that any organisation complies with anything. Where an instrument is not yet in force, this page says so rather than selling urgency.
Talk to the person who built this
If you assess clients against this instrument, the mapping is the part you can check line by line. There is no sales team: this is founder-led, so it reaches the founder directly. Tenant access is $500 a month, and free early access to the method, the corpus and the router is on offer first if that is useful. If it is not a fit, saying so costs you one reply.