ISO/IEC 42001:2023 A.5.2: AI system impact assessment process

What else in your programme already covers this

This control maps to 24 controls across 11 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27002:2022 · 4 controls

5.24 Information security incident management planning and preparation
5.31 Legal, statutory, regulatory and contractual requirements
5.34 Privacy and protection of PII
5.8 Information security in project management

NIST Cybersecurity Framework 2.0 · 4 controls

NIST-CSF-GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered
NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained
NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

EU AI Act · 3 controls

EUAI-Art.27 Fundamental rights impact assessment for high-risk AI systems
EUAI-Art.6 Classification rules for high-risk AI systems
EUAI-Art.9 Risk management system

SOC 2 · 3 controls

SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
SOC2-P6.3 P6.3 Record of unauthorised disclosures and breaches

NIST AI Risk Management Framework (AI RMF 1.0) · 2 controls

AIRMF-GV-4.2 Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate and use, and communicate about the impacts more broadly
AIRMF-MN-1.3 Responses to the AI risks deemed high priority as identified by the MAP function are developed, planned, and documented, and risk response options can include mitigating, transferring, avoiding, or accepting

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-41 Conduct a Formal Risk Analysis

ASEAN Guide on AI Governance and Ethics · 1 control

AIGE-HI-2 Assess probability and severity of harm

Australia National Framework for the Assurance of AI in Government (2024) · 1 control

1.3 1.3 Assess impact

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-DSP-09 Data Protection Impact Assessment

ISO/IEC 23894:2023 · 1 control

23894-A.4 AI System Impact Assessment

NIST SP 800-53 Rev 5 · 1 control

NIST800-RA-8 RA-8 Privacy Impact Assessments

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 A.5.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gaps If you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 each Browse the graph free