The ISO/IEC 42001 impact assessment asks what an AI system's use, and foreseeable misuse, could do to individuals, groups and society. For an agent, assess each capability that touches people, consider who is affected when it acts wrongly or unfairly, and record the result, the measures taken and the date to look again. Feed the findings into the risk assessment.
What does ISO/IEC 42001 require?
The standard requires a process for assessing the potential consequences of AI systems for individuals, groups of individuals and societies. In substance, the assessment should consider the system's deployment, its intended use and foreseeable misuse, and the technical and societal context. Results are documented, retained and, where appropriate, made available, and they inform the AI risk assessment.
The standard's control set adds detail: a defined process for impact assessments, documentation of results, and specific consideration of impacts on individuals and groups and on society. Its guidance annex points to areas such as fairness, accountability, transparency, privacy, safety, health, financial consequences and effects on rights.
Who does it apply to?
Organisations implementing ISO/IEC 42001, for AI systems within the scope of their AI management system. Developers, providers and users all carry out impact assessments, from their own position.
How is it different from the risk assessment and from legal assessments?
The AI risk assessment asks what could stop the organisation meeting its AI objectives, including consequences for people. The impact assessment looks from the outside in: what the system does to people and society, whether or not it threatens the organisation. Our guide to the ISO/IEC 42001 AI risk assessment for AI agents covers the first.
Legal assessments overlap. A GDPR data protection impact assessment focuses on risks to people's rights from processing personal data. An EU AI Act fundamental rights impact assessment applies to certain deployers of high-risk systems. The 42001 impact assessment is broader in subject and not limited by law. Our fundamental rights impact assessment template for AI agents and guide on how to run a fundamental rights impact assessment can be reused here.
What changes when the system is an agent that acts?
Agents shift impacts in three ways.
Impact comes from actions, not outputs. A recommendation that a person ignores has little effect. An agent that blocks a card, sends a final demand or closes a complaint affects someone immediately.
Impacts fall unevenly. Agents that work well for typical cases may do worse for people who write in a second language, have disabilities, or describe their circumstances in unusual ways. Those are the people most likely to be harmed and least likely to complain.
Misuse includes manipulation. Foreseeable misuse of an agent includes someone instructing it to disclose another person's data or redirect a payment. That has an impact on the victim, not the organisation alone.
How do you assess and record impact?
Work capability by capability, for each one that affects people.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Defined process | Impact assessment method with fixed questions for agents | Approved method |
| Intended use | Description of each capability, who it serves and what it does | Capability descriptions |
| Foreseeable misuse | Scenarios including manipulation and use beyond scope | Misuse scenarios |
| Impacts on individuals | Effects of a wrong or unfair action on the person, including financial and emotional harm | Impact entries per capability |
| Impacts on groups | Testing of outcomes across groups, including people likely to be vulnerable | Group outcome results |
| Impacts on society | Wider effects, such as exclusion from services or loss of trust | Societal impact notes |
| Measures | Changes made because of the assessment: limits, escalation, accessibility | Measures register |
| Documentation and availability | Assessment kept and summarised for interested parties where appropriate | Assessment record; published summary |
| Link to risk assessment | Impact findings feed risk entries | Cross-references |
| Review | Reassessment on change and on schedule | Review dates |
A worked illustration: a collections agent that drafts payment reminders and agrees short repayment plans. Individual impact: a plan that a customer cannot afford, or a reminder sent to someone who has just reported bereavement. Group impact: customers with limited literacy may agree to plans they do not understand. Measures: affordability check before any plan, vulnerability disclosures routed to a trained person, plain-language plans with a confirmation step. Review: after three months of outcomes.
What will a certification auditor ask?
- Which AI systems have impact assessments, and how did you decide scope?
- Show us how the assessment considered foreseeable misuse.
- How did you test effects on different groups?
- What changed because of the assessment?
- How do impact findings reach the risk assessment?
- What is published or shared with interested parties?
What does the requirement not cover?
It does not replace a DPIA or a fundamental rights impact assessment where law requires them, though one well-run assessment can feed all three. It does not set thresholds for acceptable impact. It does not certify an agent's performance. For how the guidance standard and the certifiable standard relate, see ISO/IEC 23894 vs ISO/IEC 42001; for the standard itself, what ISO/IEC 42001 is; and for the full map, AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Impact assessments need evidence about how agents treat real people. Pryme's Attest replays each agent capability against real cases from your own operation, including difficult ones, and its harm and escalation gates test whether the agent routes vulnerable customers to a person. Those results give the impact assessment facts rather than assumptions.
Questions people ask
Does every agent need an impact assessment?
Every agent within the management system's scope that can affect people. Internal agents that only summarise policy documents may warrant a short record explaining why impact is minimal.
Should affected people be consulted?
The standard does not mandate it, but input from customers, staff or representative groups strengthens the assessment, especially on group impacts. Record who was consulted.
Can the impact assessment be published?
Parts can. A summary of impacts considered and measures taken builds trust. Keep security-sensitive detail, such as misuse scenarios, internal.