The international standard for an Artificial Intelligence (AI) Management System, ISO 42001, is now published and alongside the common management system requirements such as leadership and risk management there is a core requirement to perform an AI Impact Assessment.

---

Scope of an AI Impact Assessment

The ISO 42001 standard has been designed for all types and sizes of organisations including those who Develop and/or Use an AI Product or Service. 

With more and more organisations utilising AI, even if it’s just for its generative capabilities, an AI Impact Assessment is becoming a common requirement within tender documents and supply chain audits.

And in the UK/EU there is already precedent with similarities to the Data Protection impact Assessment (DPIA) requirements of GDPR.

What to Consider in an AI Impact Assessment

When conducting an AI Impact Assessment you should consider your use and development of AI in the context of how it could impact an individual, groups of individuals and societies.

The AI Impact Assessment should be conducted according to a repeatable process, which is something our consultants can help you document.

If the AI Impact Assessment is part of a wider ISO 42001, the results should be used to inform the AI Risk Assessment.

Considering AI Lifecycle

As part of the AI Impact Assessment, it is important to consider the whole lifecycle of your AI product, service or use.

The AI impact assessment should be conducted before specifying or building an AI tool, so that the impacts can be managed by design.

While using the AI product or service, impacts should continue to be managed and reviewed.

And at the end of the lifecycle, where the AI product or service is discontinued or migrated to a new tool, the impacts on individuals, groups and societies should again be considered.  For example how reference data, AI models and any personal information is managed.

Types of Impact

There is no defined list of impact types and it will vary depending on the organisation and the AI involved; however below are some common considerations:

• Intended Use of the AI
• Misuse of the AI,
• Known Limitations,
• Failure of the Tool,
• Legislative Impacts, 
• Risk of Injury.