Requirement
"The organization shall assess and document the potential impacts of AI systems to individuals or groups of individuals throughout the system's life cycle."[1]
Explanation
This control drills into the human side of impact assessment: how the AI system affects the people who use it or whose data it processes, including vulnerable groups like children, the elderly and workers. Auditors expect documented analysis across areas such as fairness, privacy, safety, accessibility and human rights over the system's whole life cycle.
Implementation Guidance
- When assessing the impacts on individuals or groups of individuals, or both, and societies, the organization should consider its governance principles, AI policies and objectives. Individuals using the AI system or whose PII are processed by the AI system, can have expectations related to the trustworthiness of the AI system. Specific protection needs of groups such as children, impaired persons, elderly persons and workers should be taken into account. The organization should evaluate these expectations and consider the means to address them as part of the system impact assessment.
- Depending on the scope of AI system purpose and use, areas of impact to consider as part of the assessment can include, but are not limited to:
- fairness;
- accountability;
- transparency and explainability;
- security and privacy;
- safety and health;
- financial consequences;
- accessibility;
- human rights.
- Other information: Where necessary, the organization should consult experts (e.g. researchers, subject matter experts and users) to obtain a full understanding of potential impacts of the AI system on individuals or groups of individuals, or both, and societies.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.5.4
- ISO/IEC 42001:2023 Annex B, B.5.4 (implementation guidance)
