Requirement
"The organization shall document the results of AI system impact assessments and retain results for a defined period."[1]
Explanation
Performing an impact assessment is not enough — its results must be written down and kept. Auditors sample these records to confirm they capture intended use and foreseeable misuse, affected groups, predictable failures and mitigations, and that the organization retains them for a defined period aligned with legal or internal retention rules.
Implementation Guidance
- The documentation can be helpful in determining information that should be communicated to users and other relevant interested parties.
- AI system impact assessments should be retained and updated, as needed, in alignment with the elements of an AI system impact assessment documented in B.5.2. Retention periods can follow organization retention schedules or be informed by legal requirements or other requirements.
- Items that the organization should consider documenting can include, but are not limited to:
- the intended use of the AI system and any reasonable foreseeable misuse of the AI system;
- positive and negative impacts of the AI system to the relevant individuals or groups of individuals, or both, and societies;
- predictable failures, their potential impacts and measures taken to mitigate them;
- relevant demographic groups the system is applicable to;
- complexity of the system;
- the role of humans in relationships with system, including human oversight capabilities, processes and tools, available to avoid negative impacts;
- employment and staff skilling.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.5.3
- ISO/IEC 42001:2023 Annex B, B.5.3 (implementation guidance)
