ISO 42001 AI Risk and Impact Assessment: Practical Guide, Examples & Documentation
Introduction
An AI system can produce useful results and still create risks that an organisation has not fully considered.
A recruitment platform may rank applicants using historical data. A financial services company may use machine learning to identify unusual transactions. A manufacturer may rely on AI predictions to plan maintenance. Each application has a different purpose, but all can affect business decisions, people and operational outcomes.
The challenge is understanding what could go wrong, who may be affected and what measures are needed before and after an AI system is introduced.
ISO/IEC 42001:2023 provides a management-system framework for organisations that develop, provide or use artificial intelligence. Within this framework, AI risk assessment and AI system impact assessment are related activities, but they serve different purposes.
This practical guide explains how organisations can approach an ISO 42001 AI risk and impact assessment, identify relevant risks, evaluate possible consequences, document decisions and establish appropriate risk treatment measures.
It focuses on the assessment work itself rather than repeating a general explanation of ISO 42001 certification.
What Is an ISO 42001 AI Risk Assessment?
An AI risk assessment is a structured process for identifying, analysing and evaluating risks associated with AI activities.
Under ISO/IEC 42001:2023, Clause 6.1.2 addresses AI risk assessment. The organisation establishes a process aligned with its AI policy and objectives, designed to produce consistent and comparable results.
The assessment considers risks that may help or prevent the organisation from achieving its AI objectives.
Depending on the system, the assessment may consider:
-
Unreliable or inaccurate AI outputs
-
Inappropriate use of personal or confidential data
-
Bias or unfair outcomes
-
Insufficient human oversight
-
Cybersecurity vulnerabilities
-
Unauthorised or unintended use
-
Third-party AI service dependencies
-
Operational disruption
-
Inadequate transparency
-
Failure to meet relevant legal, contractual or customer requirements
The relevant risks depend on the AI system, its intended use, its users, the information it processes and the environment in which it operates.
An assessment should therefore be based on the organisation's actual AI activities rather than a generic list of risks.
AI Risk Assessment vs AI System Impact Assessment
These two assessments are closely connected, but they should not be treated as interchangeable.
| Assessment | Main purpose |
|---|---|
| AI risk assessment | Understand and evaluate risks in relation to organisational objectives, affected parties and relevant consequences. |
| AI system impact assessment | Examine potential consequences of developing, providing or using an AI system for individuals, groups and society. |
Clause 6.1.4 of ISO/IEC 42001 addresses AI system impact assessment. It considers the system's deployment, intended use and foreseeable misuse, along with the technical and societal context and applicable jurisdictions.
The impact assessment results should be considered within the AI risk assessment.
For example, a recruitment AI system may create an organisational risk of poor hiring decisions. An impact assessment may identify that certain groups of applicants could be disadvantaged by the system's outputs.
The impact assessment helps explain the consequences. The risk assessment considers those consequences alongside likelihood, risk criteria and organisational objectives.
The organisation should define how the two activities interact within its management system.
Step 1: Identify the AI System and Define Its Context
An assessment begins with a clear understanding of the AI system.
Before evaluating risks, establish what the system does, why it is used and who is responsible for it.
Useful information may include:
-
AI system name and owner
-
Business purpose
-
Intended use
-
Intended users
-
Internal or external deployment
-
Data sources and relevant data categories
-
Third-party services or dependencies
-
Human involvement in decisions
-
Operational environment
-
Applicable jurisdictions
-
Relevant stakeholders
Consider a company using an AI chatbot to respond to customer enquiries.
The system may use a third-party AI model, access an internal knowledge base and provide answers to customers. The assessment should consider the chatbot's intended purpose, the information it can access, the consequences of inaccurate responses and the arrangements for human escalation.
The system should be described in sufficient detail for the assessment team to understand its real operation.
Step 2: Identify AI-Related Risks
Risk identification should reflect the system's purpose and operating conditions.
A useful starting point is to examine the AI lifecycle, including development, testing, deployment, operation, monitoring, change and eventual withdrawal.
For each activity, consider what could happen, why it could happen and what the consequences might be.
Example: AI Risk Identification
| AI activity | Potential risk | Possible consequence |
|---|---|---|
| Data preparation | Incomplete or unsuitable training data | Unreliable outputs |
| Model development | Inadequate testing | Defects remain undetected |
| Deployment | Incorrect configuration | Unexpected system behaviour |
| Operation | AI output used without review | Inappropriate decisions |
| Supplier management | Third-party service changes | Reduced control or service disruption |
| Monitoring | Performance deterioration goes unnoticed | Continued use of unreliable outputs |
These examples are illustrative. They should be adapted to the actual system, context and risk criteria.
Step 3: Establish Risk Assessment Criteria
A risk assessment becomes more useful when the organisation defines how risks will be evaluated.
Without agreed criteria, different departments may assign inconsistent ratings to similar situations.
The organisation may establish criteria for:
-
Likelihood of occurrence
-
Severity of consequences
-
Impact on organisational objectives
-
Effects on individuals or groups
-
Acceptability of risk
-
Priority for treatment
-
Residual risk acceptance
A simple risk matrix may be used if it suits the organisation's activities.
For example, a company might use a five-level likelihood scale and a five-level consequence scale. The resulting rating can help prioritise further action.
However, the assessment should not rely on a numerical score alone. A low-probability event with serious consequences may still require careful attention.
The selected criteria should be documented and applied consistently.
Step 4: Evaluate the Identified Risks
Risk evaluation compares the assessment results against the organisation's established criteria.
The purpose is to determine which risks require treatment, which may be accepted and which need further analysis.
A practical evaluation may consider:
-
What could happen?
-
What is the potential consequence?
-
How realistic is the likelihood?
-
Which people, processes or objectives could be affected?
-
Is the risk within the organisation's acceptance criteria?
-
Is additional treatment required?
The organisation should record the reasoning behind important decisions.
A risk rating without a clear explanation may be difficult to review when the system changes or when a different team evaluates the same risk.
Step 5: Conduct the AI System Impact Assessment
An AI system impact assessment examines the possible effects of the AI system on individuals, groups and society.
It should consider the system's intended use and foreseeable misuse.
The assessment should reflect the context in which the AI system is developed, provided or used, including relevant jurisdictions.
Potential impact areas may include:
-
Privacy and personal information
-
Fairness and discrimination
-
Health and safety
-
Access to services or opportunities
-
Human autonomy and decision-making
-
Transparency and explainability
-
Employment and working conditions
-
Social or economic consequences
-
Effects on vulnerable or affected groups
Not every AI system will have the same impact profile.
An internal document-classification tool may have a different impact profile from an AI system that influences employment, credit, healthcare or access to public services.
The assessment should be proportionate to the system's actual use and potential consequences.
Step 6: Apply Practical AI Impact Assessment Examples
Example 1: AI Recruitment System
A company uses AI to shortlist job applicants.
Potential impact considerations:
-
Applicants may be unfairly excluded.
-
Historical data may reflect existing patterns of bias.
-
Candidates may not understand how their applications are evaluated.
-
Human reviewers may rely too heavily on automated recommendations.
Possible assessment actions include reviewing the system's intended use, testing relevant outputs, evaluating data suitability, defining human oversight and establishing a process for reviewing concerns.
The assessment should document the relevant impacts, decisions and measures.
Example 2: AI Customer Service Chatbot
A service provider uses AI to answer customer questions.
Potential impact considerations:
-
Incorrect answers may mislead customers.
-
Sensitive information may be disclosed.
-
Customers may be unable to reach a human representative.
-
The system may provide inconsistent responses.
Possible actions include limiting access to sensitive information, establishing escalation routes, monitoring outputs and reviewing incidents.
Example 3: AI Predictive Maintenance
A manufacturer uses AI to predict equipment failures.
Potential impact considerations:
-
Incorrect predictions may affect maintenance decisions.
-
Missed failures may create operational or safety consequences.
-
Excessive false alarms may disrupt production.
-
Personnel may become over-reliant on automated recommendations.
Possible actions include validating the system, defining operating limits, retaining human review where appropriate and monitoring performance.
These examples demonstrate how assessment findings can lead to practical decisions. They are not universal control requirements.
Step 7: Determine Risk Treatment Measures
Once risks have been evaluated, the organisation determines the actions needed to address them.
Risk treatment may involve:
-
Modifying the AI system
-
Changing its intended use
-
Introducing additional controls
-
Improving data management
-
Establishing human oversight
-
Strengthening supplier arrangements
-
Improving monitoring
-
Providing relevant training
-
Avoiding an activity where the risk cannot be acceptably managed
-
Accepting residual risk through the appropriate approval process
The selected treatment should address the identified risk rather than simply add a general policy.
For example, if the risk is that an AI system produces unsuitable recommendations, possible measures may include additional testing, defined operating boundaries and a human review process.
The organisation should evaluate whether the selected measures are effective.
Step 8: Maintain an AI Risk Register
An AI risk register can provide a structured record of the assessment.
ISO/IEC 42001 does not prescribe one universal risk register template. The organisation should determine an appropriate format based on its context, activities and assessment process.
A useful register may contain:
| Field | Purpose |
|---|---|
| Risk ID | Unique reference |
| AI system | System associated with the risk |
| Risk description | What could happen and why |
| Potential consequences | Effects on objectives, individuals or society |
| Likelihood | Assessment against defined criteria |
| Risk level | Result of the evaluation |
| Treatment decision | Action, acceptance or further analysis |
| Responsible owner | Person accountable for follow-up |
| Review date | Planned reassessment |
| Status | Current treatment progress |
Illustrative AI Risk Register Entry
AI system: Recruitment screening tool
Risk ID: AI-R-01
Risk description: The system may rank applicants inconsistently because the input data does not adequately represent the applicant population.
Potential consequences: Qualified applicants may be overlooked, and recruitment decisions may be affected.
Likelihood: Medium, based on the organisation's illustrative assessment criteria.
Consequence: High, based on the organisation's illustrative assessment criteria.
Treatment decision: Review data suitability, test system outputs, define human review arrangements and monitor identified concerns.
Responsible owner: Recruitment process owner.
Status: Treatment in progress.
This is an illustrative entry. The rating and treatment should not be copied without considering the actual system and context.
Step 9: Document the AI System Impact Assessment
The impact assessment should provide a clear record of the assessment process and its results.
Depending on the organisation's activities, the record may include:
-
AI system identification
-
Intended use and foreseeable misuse
-
Relevant context and jurisdictions
-
Affected individuals or groups
-
Potential consequences
-
Assessment criteria
-
Identified impacts
-
Mitigation measures
-
Relevant decisions
-
Approval or review information
-
Reassessment triggers
The organisation should also establish how impact assessment findings are considered in its AI risk assessment.
The results should be documented. Where appropriate, relevant results may be made available to interested parties.
Step 10: Review and Update the Assessments
AI systems can change after deployment.
Data sources may be updated, models may be replaced, suppliers may introduce new functionality and the system's intended use may expand.
An assessment that was suitable at one point may no longer reflect the current system.
Organisations should establish suitable review arrangements and reassess when relevant changes occur.
Examples of potential reassessment triggers include:
-
Significant changes to the AI system
-
Changes in intended use
-
New data sources
-
Material performance deterioration
-
New incidents or complaints
-
Changes in relevant requirements
-
New deployment locations
-
Changes to third-party services
ISO/IEC 42001 Clause 8.4 addresses AI system impact assessments at planned intervals or when significant changes are proposed.
The organisation should retain documented information of the assessment results.
ISO 42001 AI Risk and Impact Assessment Documentation Checklist
The following checklist can help an organisation review its assessment arrangements.
-
AI systems within the management-system scope are identified.
-
Intended use and relevant context are documented.
-
Risk assessment criteria are established.
-
The risk assessment process is defined.
-
Relevant AI risks are identified.
-
Potential consequences are evaluated.
-
Likelihood is assessed where applicable.
-
Risk evaluation criteria are applied consistently.
-
Impact assessment findings are considered in risk assessment.
-
Treatment decisions are recorded.
-
Relevant responsibilities are assigned.
-
Residual risk acceptance is addressed.
-
Assessment records are maintained.
-
Relevant changes trigger reassessment.
-
Monitoring and review arrangements are established.
This is a practical preparation checklist, not a universal mandatory document list. The organisation should determine its actual requirements from ISO/IEC 42001 and its own context.
How AI Risk and Impact Assessment Supports ISO 42001 Certification
AI risk and impact assessment supports the organisation's wider Artificial Intelligence Management System.
The assessment helps demonstrate how AI-related risks are identified, evaluated and addressed within the management system.
During certification assessment, the relevant evidence depends on the organisation's scope, activities and applicable requirements.
The organisation should be able to explain its assessment methodology, demonstrate how decisions were made and show that relevant processes are implemented.
Maintaining a risk register alone does not demonstrate that an AI management system is effectively implemented. The assessment should be connected to actual operational arrangements, controls, monitoring and management decisions.
For broader information about the standard, see the SCS guide to ISO 42001 and Artificial Intelligence Management Systems.
For focused guidance on records and documentation, see ISO 42001 Documentation Requirements and Audit Records.
ISO 42001 AI Risk and Impact Assessment Across Countries
ISO/IEC 42001:2023 provides an international management-system framework. Organisations in different countries can use the assessment approach to evaluate AI-related risks and impacts within their own context.
The technical assessment methodology may be similar, but the relevant jurisdictions, legal obligations, affected parties, deployment conditions and certification arrangements can differ.
A company operating in Malaysia, Singapore, Canada, India, the UAE or another country should consider the context in which its AI systems are developed, provided or used.
For country-specific ISO 42001 certification information, explore the relevant SCS guides:
For the UAE, refer to the existing ISO 42001 Certification in UAE guide.
Canada and other country links should be added when their corresponding SCS certification pages are published and verified. This global assessment guide can remain the shared supporting resource.
Conclusion
An effective ISO 42001 AI risk and impact assessment begins with understanding the AI system and its intended use.
The organisation then identifies relevant risks, evaluates potential consequences, considers impacts on individuals and society, establishes treatment measures and maintains assessment records.
The practical value lies in connecting assessment findings to real decisions and ongoing oversight.
A well-maintained assessment process gives an organisation a clearer understanding of its AI activities and provides useful evidence for the wider AI management system.
Discuss ISO 42001 Certification with SCS
SCS Certification can discuss your organisation's proposed AI management system scope and certification assessment arrangements.
If your organisation is preparing for ISO 42001 certification, contact SCS to discuss the next steps.
Need ISO Certification for Your Business?
Speak with our certification specialists to understand certification requirements, audit process, implementation timelines and accredited certification services.
