ISO/IEC 42005:2025

ISO/IEC 42005:2025 guides organizations developing, providing or using AI systems on performing AI system impact assessments for the individuals, groups and societies an AI system and its foreseeable applications can affect, and on documenting them. Clause 5 sets up the process: a structured approach shaped by internal and external factors including prohibited AI uses; documenting the process; integrating it with organizational risk assessment and with privacy, security, safety, human rights and other impact assessments; when to assess and reassess (changes in use, users, data, performance, environment, law) with triaging for high-risk systems; scope and the organization's role in the AI ecosystem; multidisciplinary responsibilities; thresholds for sensitive and restricted uses and impact scales; performing, analysing, recording, approving, monitoring and reviewing. Clause 6 sets the assessment document's contents: scope, AI system description, capabilities, purpose, intended and unintended uses, data information and quality, algorithm and model information, deployment geography and constraints, directly affected and other interested parties, benefits and harms, failures and reasonably foreseeable misuse, and the measures adopted. Annexes align it with ISO/IEC 42001 (whose A.5 controls and B.5 guidance it elaborates), ISO/IEC 23894, a harms and benefits taxonomy, other assessments and a template. Guidance, not certifiable; the EU AI Act's fundamental rights impact assessment and the NIST AI RMF MAP and MEASURE functions are the regimes it is most often used against.