An AI impact assessment records how a system can affect people, groups and society, including foreseeable misuse. ISO/IEC 42005 is the guidance firms use for that work. It supports the impact controls in an AI management system. It is not a certificate, and it does not replace an AI risk assessment of likelihood and harm.

When an AI impact assessment is the right record

You need an AI impact assessment when the system can change a person’s job, credit, care, schooling or access to a service. Downtime is a real loss. It is the wrong headline for this file. A meeting-notes model can still need an AI impact assessment if staff paste customer names into the prompt. The question is who can be helped or harmed, not whether the server stayed up.

Keep the AI impact assessment beside the system record. A deck named Final_v7 is not a record. Name the system, the version and the intended use in the first three lines. If the model has no owner, stop and fix that before you write a long narrative about society. An ownerless model produces an ownerless harm story, and a Stage 2 auditor will sample the gap in minutes.

Run the work before deployment, and again when the use changes. The AIMS treats a new purpose as a new file.

What ISO 42005 asks you to record

ISO 42005 is guidance. It is not a certificate. ISO/IEC 42001:2023 is the standard a certification body can audit. The impact guidance supports Annex A, especially the controls that ask you to judge effects on individuals, groups and society. It does not replace clause 6 planning, and it does not replace your risk register.

Use ISO 42005 to set depth. A hiring screen needs a fuller record than a spellchecker inside an editor. Scale matters. So does reversibility. A wrong word in a draft email is easy to undo. A rejected candidate or a refused loan is not. Write the depth decision in one line so the next reviewer does not reopen the argument from zero.

ISO 42005 supports Annex A impact controls in the AI management system. It does not replace clause 6. You still need objectives, a risk process and operational controls. Think of the impact file as the page that forces a human effect into that system. Without it, the risk row talks about accuracy and the board hears nothing about people.

AI impact assessment sections for individuals, groups and wider societal effects
Impact record AI risk assessment
Main question Who is affected, and how How likely, and how severe
Guidance you can cite ISO/IEC 42005 ISO/IEC 23894
Home in the AIMS Annex A impact controls and the system file Risk register under clause 6
Fails when It names no person and no misuse It scores only model accuracy

Buyers in Europe may ask how you thought about a high-risk use. Annex III duties under the EU AI Act have applied since 2 August 2026. An impact record shows that thinking. It does not create a presumption of conformity. As of 31 October 2026, DPDP Act rules in force cover definitions and the Data Protection Board. Main fiduciary duties commence on 13 May 2027. If the model uses personal data, name it in the data row now.

A Statement of Applicability will point at the impact controls. Check the certification body on the NABCB or IAF directory for an accredited scope. Stage 1 reads the paper. Stage 2 samples live systems, and a surveillance audit can return later. ISO 27001 will not contain this page unless you added it.

Fields on an AI system impact assessment template

Copy an AI system impact assessment template into the evidence folder and retire the slide. An AI system impact assessment template earns its place when residual impact is written in words a director will actually read. Keep the AI system impact assessment template boring. No column for a vague score that has no sentence under it. The closing rows are what make an AI impact assessment usable when a certification body asks for a sample.

Field What you write
System Name, version, build or buy
Intended use The decision it may support, and what it must not decide
Individuals affected The person who can be helped or harmed
Groups Cohorts, not a single anecdote
Societal effect What changes if this pattern spreads
Foreseeable misuse The likely wrong use, including a busy manager’s shortcut
Human oversight Who can override, and before which step
Data Sources, sensitivity, and whether personal data is in play
Residual impact What harm remains after the controls you already have
Owner A named person who can stop the release
Review On change of use, and on a set calendar if nothing changes

Use the same AI system impact assessment template for the hiring illustration and the lending illustration so the files can be compared. Fill one live system on the AI system impact assessment template before you ask for a portal. A portal that arrives first will freeze last month’s empty columns.

Two illustrations, labeled as illustrations

Treat each illustration below as a teaching AI impact assessment, clearly labeled, not as your file. These are not client records. They show how the fields sound when someone has actually met the system.

Illustration A, a hiring screen. A product firm ranks resumes for sales roles. Intended use: order the pile, not auto-reject. Individuals: applicants. Groups: people returning from a career break, and applicants from colleges past hires rarely came from. Societal effect: if peers copy the pattern, the hiring pool narrows. Foreseeable misuse: a manager skips the CV, or points the model at a role it never saw. Human oversight: the recruiter signs before any rejection. Data: CVs and past hire labels. Residual impact: a strong applicant from a non-target college still ranks too low. Owner: the talent lead. Review: any model change, and at least yearly.

Illustration B, a lending score. A lender suggests a limit on a small-business loan. Intended use: advice to a credit officer, not an automatic decline. Individuals: the applicant. Groups: first-time borrowers, and firms in one district. Societal effect: repeated declines can dry up working capital there. Foreseeable misuse: the branch treats the score as the decision, or uses a business-loan model on personal loans. Human oversight: the officer may approve against the score and must write why. Data: bank statements and GST filings. Residual impact: a viable borrower is still delayed. Owner: head of credit. Review: on policy change, and after a spike in complaints.

The hiring case fails if “groups” says “all candidates”. The lending case fails if oversight names nobody.

What a weak AI impact assessment looks like in a Stage 2 sample

Auditors mark down an AI impact assessment that says low and never names a person. Refresh the AI impact assessment when intended use changes, and at least once a year if it does not. The owner on the AI impact assessment is the person who can stop the release. If that name is a shared mailbox, you do not have an owner.

Annex A asks the firm to run an AI impact assessment process and to file the result. In a Stage 2 sample the auditor picks one system and asks who last changed the intended use. Those two documents should tell the same story.

Read ISO 42005 next to the AIMS, then complete one system this month. Do it for the system a customer will ask about. Finish one file a director will sign, then copy the habit.

Take one system into a working session

Download the template and send the system name through the contact page. We will use your inventory, not a stock story about a bank you do not run. The service outline is here: https://www.sevenstepconsulting.com/iso-42001-aims-artificial-intelligence-management-system/ and you can write to us at https://www.sevenstepconsulting.com/contact-us/.