ISO 42001 Annex A 5.3 Document and retain AI impact assessment results
What it says
The organization shall document the results of AI system impact assessments and retain results for a defined period.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishYour organisation must write down the results of every AI (artificial intelligence) system impact assessment and keep those records for a set period of time.
An AI system impact assessment is a check of how an artificial intelligence (AI) system could affect people, such as customers, staff, or the wider community, before and while you use it. This control is not about doing the assessment itself; it is about what you do with the outcome. It requires two things. First, you must write down the results of each assessment so they exist as a clear record rather than living in someone's head or a verbal conversation. Second, you must keep those written results for a defined period, meaning your organisation decides in advance how long the records must be retained (for example three or five years) and then actually holds onto them for that time. Think of it like keeping the inspection report for a building. The inspection might happen once, but you keep the signed report on file so that later, if a regulator, an auditor, a customer, or your own board asks, you can show what was checked, what was found, and what was decided. Without a written and retained record, you cannot prove you considered the impact of your AI, and you cannot look back to see whether earlier concerns were dealt with.
Free. Save your status, tasks and notes.
Why it matters
If results are not documented and retained, the organisation cannot prove it assessed its AI's impact, leaving it exposed in audits, disputes, or regulatory reviews.
How to implement
The person responsible for the AI management system (AIMS) should create a standard template for recording impact assessment results, so every assessment captures the same details such as the AI system name, date, who carried it out, the impacts identified, and the decisions made.
The compliance manager should set a written retention period for these records (for example three or five years) and record this in a policy, basing the length on any legal, contractual, or regulatory requirements that apply to your organisation.
The records owner should store completed impact assessment results in a single, access-controlled location such as a managed document library, so they cannot be casually deleted, overwritten, or lost when staff leave.
The AIMS owner should keep a register that lists every AI system and links to its corresponding impact assessment record, making it quick to confirm that no system is missing its documented results.
The compliance manager should schedule a periodic check (for example annually) to confirm that records are still being kept for the full defined period and that nothing has been deleted before its retention date.
Keep it running
Set the retention period once in policy, store results in a controlled location, and review yearly to confirm nothing was deleted before its retention date.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
to see the documented results of impact assessments for two or three named AI systems, and confirm each one is written down rather than described verbally.
Look at
whether the organisation has a stated retention period for these records and where it is defined, such as in a policy or procedure.
- Check 2 of 2What an auditor asks for
Ask for
how and where the results are stored, and check that the storage location protects records from accidental or unauthorised deletion before the retention period ends.
Look at
the dates on the retained records to confirm older assessments are still available and have not been purged earlier than the defined period allows.
Good evidence
a complete, dated set of written impact assessment results held in a controlled location, a clearly defined retention period, and evidence that records from earlier years are still retained as required.
Mappings
Closest match in ISO/IEC 27001: A.5.33, Protection of records, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.33.
ISO/IEC 42001:2023 Annex A 5.3 mandates documenting and retaining AI impact assessment results. ISO/IEC 27001:2022 Annex A 5.33 requires record protection from loss and unauthorised actions, directly addressing the security of stored AI impact assessment records.
This control partially overlaps A.8.10.
Annex A 5.3 requires the organisation to document AI system impact assessment results and retain them for a defined period. Annex A 8.10 overlaps by requiring secure deletion of information when no longer needed, which complements retention by ensuring impact assessment records are disposed of securely once the defined retention period expires. Annex A 5.3 is primarily about documenting and keeping the assessment results, whereas Annex A 8.10 is about end-of-life handling and secure disposal across all information types.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents