International · Guidance standard
ISO/IEC 42005 AI system impact assessment, in practice
ISO/IEC 42005:2025 gives guidance for assessing how an AI system and its foreseeable applications can affect individuals and societies. Published on 28 May 2025 as a first edition, it covers how and when to assess, at which lifecycle stages, what the assessment record should contain, and how to fold the assessment into AI risk management and an AI management system. For AI agents, it is the method for working out what an agent could do to the people it reaches before it is deployed.
In the FairMind catalogue: 1 requirement mapped to 3 workflows.
Source: IEC Webstore: ISO/IEC 42005:2025
ISO/IEC 42005: what it asks of AI systems
The parts most relevant to governing AI systems and agents, summarised from the ISO/IEC 42005:2025 AI system impact assessment.
- MethodImpact assessment process guidance (whole standard)
- FairMind uses the standard as the method behind its impact assessment workflows rather than mapping it clause by clause, because the ISO text is licensed.Mapped to: Impact assessment
Evidence FairMind helps you produce
FairMind links technical evidence to ISO/IEC 42005 obligations for a human reviewer to accept. It is not legal advice and does not decide compliance.
- AI system impact assessments per system, with reviewer sign-off and open impacts left visible
- Workforce impact and consultation records
- Accessibility and inclusion reviews
- Links from each assessment to the ISO/IEC 42001 risk records it feeds
ISO/IEC 42005 questions
How does ISO/IEC 42005 relate to ISO/IEC 42001?
ISO/IEC 42001 requires an AI system impact assessment process (clause 6.1.4). ISO/IEC 42005 is guidance on how to carry one out. Teams working toward 42001 certification can use 42005 as the method for that process.
Is an ISO/IEC 42005 assessment a DPIA?
No. It can feed a GDPR Data Protection Impact Assessment or an EU AI Act fundamental rights impact assessment, but it does not replace either.
How does FairMind map ISO/IEC 42005?
The catalogue treats the whole standard as the method for impact assessment and links it to 3 workflows. A person approves every assessment before it is filed.