ISO 42001 Annex A 5.5 Assess and document AI societal impacts across the life cycle
What it says
The organization shall assess and document the potential societal impacts of their AI systems throughout their life cycle.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishYour organisation must assess and write down how each artificial intelligence (AI) system could affect society at every stage of its life.
This control asks your organisation to think about how your artificial intelligence (AI) systems could affect people and society more broadly, not just your own business. Before you build or buy an AI system, while you run it, and right through to when you retire it, you need to consider questions like: could this system treat some groups of people unfairly, mislead the public, affect jobs, raise safety concerns, or harm vulnerable communities? You then have to write down what you found and the decisions you made about it. The key word is "throughout their life cycle", meaning this is not a one-off check at the start. As an AI system changes, as it is used in new ways, or as its effects on the world become clearer, you revisit the assessment and keep your records up to date. The point is to spot potential harm to society early so you can prevent it, rather than discovering it after damage is done. Having this written down also shows regulators, customers and your board that you took the wider consequences of your AI seriously.
Free. Save your status, tasks and notes.
Why it matters
Skipping societal impact checks risks unfair or harmful AI outcomes that damage public trust, attract regulators and expose your organisation to legal claims.
How to implement
The AI management system (AIMS) owner should create a standard societal impact assessment template that asks set questions about effects on fairness, safety, employment, the environment, vulnerable groups and the wider public, so every AI system is reviewed consistently.
Project leads should complete this assessment before an AI system is approved for build or purchase, recording who could be affected, what harm could occur and how likely and serious it is.
The risk or compliance manager should schedule the assessment to be repeated at set points across the life cycle, for example when the system changes significantly, when it is used for a new purpose, and before it is retired.
Business and product teams should consult affected or external groups where impacts could be serious, such as community representatives or domain experts, and record their input in the assessment.
The AIMS owner should store every completed and updated assessment in a central register, link each one to the relevant AI system, and report significant findings to senior management for a documented decision.
Keep it running
Treat the assessment as living: revisit it whenever an AI system changes, is reused for a new purpose, or is retired, and keep the register current.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
the documented societal impact assessment for a sample of AI systems, and check that one exists for each system in use.
Look at
whether each assessment covers genuine societal effects, such as fairness, safety, jobs, the environment and impacts on vulnerable people, rather than only technical or commercial risks.
- Check 2 of 2What an auditor asks for
Ask for
evidence that assessments are revisited across the life cycle, and look at dates and version history to confirm they were updated when systems changed or were retired.
Look at
whether serious potential impacts were escalated to senior management and whether a documented decision or mitigation followed.
Good evidence
a complete, dated register of societal impact assessments tied to each AI system, refreshed at key life cycle stages, with clear evidence that findings influenced real decisions.
Mappings
Closest match in ASD Information Security Manual: ISM-1203, Risk assessment for system security, which partially overlaps with this control.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-1203.
Annex A 5.5 requires the organisation to assess and document potential societal impacts of AI systems across the full AI system life cycle. ISM-1203 requires system owners to conduct a threat and risk assessment for each system, which can include consideration of harms arising from system use and misuse (including AI-enabled systems). The overlap is in structured assessment and documentation of impacts/risks, but ISM-1203 is focused on security threats and risks rather than broader societal impacts (e.g., fairness, human rights, social harm) required by Annex A 5.5.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents