3.6 AI System Impact Assessment (Clause 6.1.4 & Annex A.5)

3.6 AI System Impact Assessment (Clause 6.1.4 & Annex A.5)

One of the most defining innovations of ISO/IEC 42001 is Clause 6.1.4, which mandates that organizations perform an AI System Impact Assessment (AISIA). While traditional management standards focus almost exclusively on internal risks to the business, ISO/IEC 42001 requires organizations to systematically evaluate how their AI systems affect external stakeholders, individuals, vulnerable populations, society at large, and the environment. This requirement aligns directly with control objectives in Annex A.5 (AI System Life Cycle).

---

Distinguishing Risk Assessment from Impact Assessment

Understanding the fundamental distinction between Clause 6.1.2 (Risk Assessment) and Clause 6.1.4 (Impact Assessment) is essential for AIMS implementers:

• AI Risk Assessment (Clause 6.1.2): Focuses primarily on threats to the organization's objectives (e.g., operational failure, financial loss, regulatory penalties, IP leakage, reputational damage).
• AI System Impact Assessment (Clause 6.1.4): Focuses explicitly on potential harm to external entities (e.g., individuals denied credit due to bias, workers displaced by automation, environmental degradation from massive compute workloads, erosion of civil liberties).

+-----------------------------------------------------------------------+
|                   CLAUSE 6.1.2 vs CLAUSE 6.1.4 FOCUS                  |
|                                                                       |
|   +--------------------------+       +----------------------------+   |
|   |   Clause 6.1.2 Risk      |       |  Clause 6.1.4 Impact       |   |
|   |   (Internal Enterprise)  |       |  (External Stakeholders)   |   |
|   |  - Revenue Loss          |       |  - Human Rights Violations |   |
|   |  - Regulatory Fines      |       |  - Algorithmic Bias        |   |
|   |  - IP Leakage            |       |  - Physical Safety Hazards |   |
|   |  - System Downtime       |       |  - Environmental Carbon    |   |
|   +--------------------------+       +----------------------------+   |
+-----------------------------------------------------------------------+

---

Fundamental Rights Impact Assessment (FRIA) & EU AI Act Alignment

Clause 6.1.4 creates direct alignment with emerging international regulations, most notably Article 27 of the European Union AI Act, which mandates a Fundamental Rights Impact Assessment (FRIA) for deployers of high-risk AI systems. An ISO/IEC 42001 AISIA satisfies FRIA requirements by systematically evaluating:

• Impact on fundamental rights protected under international charters (privacy, non-discrimination, freedom of expression).
• Specific categories of persons or groups likely to be affected (e.g., job applicants, loan borrowers, patients).
• Specific human oversight measures deployed to prevent automated harm.
• Verification of post-deployment monitoring mechanisms.

---

Core Impact Assessment Dimensions

An ISO/IEC 42001 compliant impact assessment must evaluate potential effects across four primary dimensions:

1. Human Rights & Civil Liberties

Evaluating potential infringements on personal privacy, freedom of expression, human dignity, and protection against automated profiling or mass surveillance. For example, deploying facial recognition in public spaces requires rigorous evaluation under this dimension.

2. Algorithmic Equity & Non-Discrimination

Assessing whether model predictions disproportionately penalize protected demographic groups (e.g., bias in hiring algorithms, tenant screening tools, or loan approval models). Assessments must verify data representativeness and test for disparate impact.

3. Health, Safety & Physical/Psychological Wellbeing

Evaluating physical safety hazards (e.g., AI-driven autonomous robotics, medical diagnostic software) and psychological impacts (e.g., addictive social media recommendation algorithms or conversational AI inducing emotional distress).

4. Environmental & Ecological Sustainability

Quantifying compute energy usage, carbon emissions, and resource consumption associated with training and hosting large-scale AI models under Annex A.5 controls.

---

End-to-End AISIA Execution Workflow

Impact assessments must not be treated as a single static checkmark. They must be executed dynamically across five key workflow steps:

---

Mandatory Triggers for Impact Re-Assessment

Clause 6.1.4 explicitly mandates that impact assessments be kept up to date. Re-assessments are strictly required whenever any of the following triggers occur:

1. Model Architecture Updates: Transitioning from a domain-specific model to a multi-modal foundation model or altering hyperparameter weightings.
2. Training Data Distribution Shifts: Ingesting new dataset sources or retraining models on significantly altered demographic distributions.
3. Operational Context Change: Deploying an internal decision-support model directly into a customer-facing automated execution channel.
4. Discovery of Incidents or Anomalies: Uncovering algorithmic bias, unexpected hallucination rates, or safety near-misses in production.

---

Worked Implementation Scenario: HR Recruitment AI Impact Assessment

Context: An enterprise enterprise deploys an automated resume screening algorithm to rank job applicants.

Execution Steps:

1. Stakeholder Mapping: The team identifies job applicants—specifically protected demographic groups—as affected stakeholders.
2. Impact Identification: The AISIA reveals a severe risk of gender bias because historical hiring data used for training contained 80% male resumes.
3. Mitigation Mapping: The team implements Annex A.6 controls (re-balancing dataset, masking gender indicators) and Annex A.8 controls (requiring HR recruiters to manually review all rejected resumes).
4. Sign-Off: The AI Ethics Board approves the AISIA, establishing a quarterly re-assessment schedule.

---

Lead Implementer Exam Tips

• Internal vs External Focus: Master the distinction: Clause 6.1.2 = Internal enterprise risk; Clause 6.1.4 = External stakeholder impact.
• Environmental Inclusion: Remember that environmental sustainability (carbon emissions, energy compute tracking) is explicitly included within Clause 6.1.4 impact assessments under Annex A.5.
• FRIA Alignment: Understand that an AISIA under Clause 6.1.4 directly satisfies EU AI Act Article 27 FRIA requirements.