ISO/IEC 42005 AI System Impact Assessment
Describe an AI system, identify who it affects, weigh benefits against potential harms to individuals, groups and society, and generate a draft impact assessment with a harms register, residual impact and sign-off.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- ISO/IEC 42005 gives guidance on assessing how an AI system could affect individuals, groups and society; ISO/IEC 42001 expects you to run such assessments.
- This template walks through system description, intended use and misuse, affected parties, benefits, a harms register and the sign-off decision.
- The harms register rates likelihood and severity, records mitigations and residual impact, and flags severe harms that have no mitigation.
- Eighteen quality checks show whether the assessment would stand up to review, with material gaps flagged.
Frequently asked questions
What is an AI system impact assessment?
A structured look at how an AI system could benefit or harm the people and groups it touches, and society more broadly, before and during its use. It records the system, its intended use, affected parties, potential harms, mitigations, the impact that remains and who accepted it.
How is it different from a risk assessment or a DPIA?
A risk assessment centres on risk to the organisation and its objectives; an impact assessment centres on effects on people and society. A data protection impact assessment covers personal data processing. They overlap, so link them rather than duplicate them.
Does this reproduce ISO/IEC 42005?
No. The structure and prompts are written in our own words. You need your own copy of the standard to apply it.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.