ISO 42001 Annex A 5.4 Assess and document AI impacts on individuals and groups
What it says
The organization shall assess and document the potential impacts of AI systems to individuals or groups of individuals throughout the system's life cycle.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe organisation must assess and document how its artificial intelligence (AI) systems could affect individuals or groups of people across the whole life of each system.
This control is about working out, in advance and on an ongoing basis, how your artificial intelligence (AI) systems could affect real people. An AI system might influence someone's job application, a loan decision, the price they are offered, or how they are treated by a service. Some of those effects can be harmful, such as unfair treatment of a particular group, loss of privacy, or a decision that disadvantages someone with no easy way to challenge it. This control requires you to deliberately look for those possible impacts, write them down, and keep that assessment current throughout the system's life cycle, meaning from the first idea, through building and launching it, while it runs day to day, and right up to when you retire it. The point is that you understand the human consequences of your AI before they cause harm, and that you have a written record showing you thought it through. As part of your AI management system (AIMS), this documented assessment becomes evidence that you take responsibility for how your AI affects people, not just whether it works technically.
Free. Save your status, tasks and notes.
Why it matters
If you never assess how an AI system affects people, it can quietly harm individuals or unfairly disadvantage whole groups before anyone notices.
How to implement
The AI lead should keep a register of every AI system in use or under development and, for each one, record which individuals or groups it could affect, such as customers, employees, job applicants, or vulnerable people.
The risk owner should run a structured impact assessment at the start of each AI project that asks how the system could harm people through unfair treatment, privacy loss, exclusion, financial detriment, or safety, and document the findings before the system goes live.
The project team should repeat or review each impact assessment at defined points in the life cycle, for example after a major change, after retraining the model, or at least annually, and date-stamp each version so changes over time are visible.
The product owner should pay particular attention to impacts on groups rather than just individuals, checking whether any outcome falls more heavily on people sharing a characteristic such as age, gender, disability, or location, and record that analysis.
The compliance manager should store all completed impact assessments in one accessible place and link each one to the decision it informed, so the organisation can show that documented impacts actually shaped how the AI system was designed, used, or restricted.
Keep it running
Refresh each impact assessment whenever a system materially changes or is retrained, and review all of them on a regular schedule, such as annually.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
a list of the organisation's AI systems and the documented impact assessment for each one, then check that every live system has an assessment rather than only the flagship products.
Look at
a sample of impact assessments and confirm they actually name the individuals or groups affected and describe specific potential harms, not just generic statements that the system is safe.
- Check 2 of 2What an auditor asks for
Ask for
how impacts on groups of people were considered, and look for evidence that the organisation checked whether outcomes disadvantage a particular group, since good practice covers both individuals and groups.
Look at
the dates and version history of the assessments to confirm they are reviewed across the life cycle, for example updated after major changes or retraining, rather than written once and forgotten.
Good evidence
a current, dated impact assessment for each AI system that names affected people, lists realistic harms, and is clearly linked to design or operating decisions the organisation took as a result.
Mappings
Closest match in ISO/IEC 27001: A.5.34, Privacy and protection of personally identifiable information, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.34.
Annex A 5.4 (ISO/IEC 42001:2023) requires the organisation to assess and document how AI systems may impact individuals or groups over the life cycle, which commonly includes privacy-related impacts. Annex A 5.34 (ISO/IEC 27001:2022) requires identifying and meeting privacy and PII protection requirements, overlapping where AI impacts arise from PII processing, profiling, or inference. Annex A 5.4 extends beyond privacy compliance into broader human and societal impacts, while Annex A 5.34 is specifically scoped to privacy/PII obligations and controls.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-1203.
Annex A 5.4 (ISO/IEC 42001:2023) requires the organisation to assess and document potential impacts of AI systems on individuals and groups across the AI system life cycle. ISM-1203 requires system owners to conduct a threat and risk assessment for each system, which can include considering harms to people where those harms arise from cyber threats or security weaknesses in an AI-enabled system. The primary control is broader in impact type (including non-security and socio-technical impacts such as fairness, discrimination, autonomy, and wellbeing), while ISM-1203 is primarily focused on security threat/risk to the system and organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents