ISO/IEC 42001:2023 A.5.4: Assessing AI system impact on individuals or groups of individuals

What else in your programme already covers this

This control maps to 27 controls across 10 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27001:2022 · 4 controls

5.24 Information security incident management planning and preparation
5.31 Legal, statutory, regulatory and contractual requirements
5.34 Privacy and protection of personal identifiable information (PII)
8.25 Secure development life cycle

NIST Cybersecurity Framework 2.0 · 4 controls

NIST-CSF-GV.OC-02 Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered
NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained
NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

SOC 2 · 4 controls

SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)
SOC2-P3.1 P3.1 Collecting personal information consistent with objectives
SOC2-P4.1 P4.1 Limiting use to identified purposes
SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties

ASEAN Guide on AI Governance and Ethics · 3 controls

AIGE-OM-3 Bias identification and mitigation
AIGE-P2 Fairness and Equity
AIGE-P4 Human-centricity

EU AI Act · 3 controls

EUAI-Art.27 Fundamental rights impact assessment for high-risk AI systems
EUAI-Art.5 Prohibited AI practices
EUAI-Art.9 Risk management system

ISO 27002:2022 · 3 controls

5.31 Legal, statutory, regulatory and contractual requirements
5.34 Privacy and protection of PII
5.8 Information security in project management

Australia AI Ethics Framework · 2 controls

AUAIE-2 Human-centred values
AUAIE-3 Fairness

Australia National Framework for the Assurance of AI in Government (2024) · 2 controls

2.1 2.1 Comply with rights protections
3.1 3.1 Define fairness in context

NIST AI Risk Management Framework (AI RMF 1.0) · 1 control

AIRMF-MP-5.1 Likelihood and magnitude of each identified impact are identified and documented, based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team, or other data

NIST SP 800-53 Rev 5 · 1 control

NIST800-RA-8 RA-8 Privacy Impact Assessments

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 A.5.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gaps If you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 each Browse the graph free