International IEC ISO Standard IS0/IEC 42005 First edition Information technology Artificial 2025-05 intelligence (AI) AI system impact assessment Technologies de I'information - Intelligence artificielle (IA) - Evaluation de I'impact des systemes d'IA Reference number IS0/IEC 42005:2025(en) @ ISO/IEC 2025 IS0/IEC 42005:2025(en) COPYRIGHT PROTECTED DOCUMENT @ IS0/IEC 2025 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either IsO at the address below or ISO's member body in the country of the requester. ISO copyright office CP 40i : Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +41 22 749 01 11 Email: [email protected] Website: www.iso.org Published in Switzerland @ IS0/IEC 2025 - All rights reserved ii IS0/IEC 42005:2025(en) Contents Page Foreword. .V Introduction ..vi Scope. 1 .1 2 Normative references .1 3 Terms and definitions .1 4 Abbreviated terms .2 5 Developing and implementing an AI system impact assessment process. .3 5.1 ..3 General. 5.2 ..3 Documenting the process. 5.3 Integration with other organizational management processes. 5.4 Timing of AI system impact assessment .4 5.5 Scope of the AI system impact assessment. 5.6 Allocating responsibilities. ..5 5.7 Establishing thresholds for sensitive uses, restricted uses and impact scales ..6 5.8 Performing the AI system impact assessment. .7 5.9 Analysing the results of the AI system impact assessment. .7 5.10 Recording and reporting.. 5.11 Approval process. 5.12 Monitoring and review. 8 6 Documenting the AI system impact assessment .9 6.1 General .9 6.2 Scope of the AI system impact assessment 6.3 AI system information. ..9 6.3.1 AI system description .9 6.3.2 AI system functionalities and capabilities .10 6.3.3 AI system purpose. .10 6.3.4 Intended uses. ..10 6.3.5 .10 Unintended uses 6.4 Data information and quality .11 6.4.1 General ..11 6.4.2 Data information. ..11 6.4.3 Data quality documentation .12 6.5 Algorithm and model information. .12 .. 12 6.5.1 General 6.5.2 Information on algorithms used by the organization 12 6.5.3 13 Information on algorithm development. 6.5.4 Information on models used in an AI system .13 6.5.5 Information on model development. .13 6.6 Deployment environment. .14 6.6.1 Geographical area and languages .14 6.6.2 Deployment environment complexity and constraints ..14 6.7 Relevant interested parties.. .15 6.7.1 15 General 6.7.2 Directly affected interested parties 15 6.7.3 Other relevant interested parties .15 6.8 Actual and reasonably foreseeable impacts .15 6.8.1 15 General. 6.8.2 Benefits and harms.. ..16 6.8.3 AI system failures and reasonably foreseeable misuse .19 6.9 Measures to address harms and benefits .19 Annex A (informative) Guidance for use with IS0/IEC 42001 .21 Annex B (informative) Guidance for use with IS0/IEC 23894 .23 @ IS0/IEC 2025 - All rights reserved iii IS0/IEC 42005:2025(en) Annex C (informative) Harms and benefits taxonomy .25 Annex D (informative) Aligning AI system impact assessment with other assessments .27 Annex E (informative) Example of an AI system impact assessment template ..31 Bibliography. ..38 @ IS0/IEC 2025 - All rights reserved iv IS0/IEC 42005:2025(en) Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of IsO or IEC participate in the development of International Standards through technical ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. The procedures used to develop this