Impact assessment at planning

The requirement, in our words

Set out how the organization will assess the consequences of developing, providing or using AI systems for individuals, groups and society. The assessment must cover intended use, reasonably foreseeable misuse, the technical and societal context and the applicable jurisdictions, and it must be documented.

What it means for human oversight

The impact assessment names the harms the overseer is watching for. Without it, oversight becomes a general instruction to be careful, which cannot be tested or measured.

How to evidence it

Attach the artefacts above to the Impact assessment at planning row with the system name, the owner and the date. The first one is the anchor: The impact assessment procedure. The OH-06 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Completed assessments covering intended use and foreseeable misuse. If that artefact for OH-06 cannot be produced, the row is a gap, whatever the policy says.

OH-06 carries 3 evidence items and 2 common gaps. For impact assessment at planning, link the row to the assessment page that names the harm, because an overseer cannot watch for a consequence the file never describes. The OH-06 statement above is ours, written from ISO/IEC 42001:2023, 6.1.4, not a reproduction of the licensed text.

Common gaps

• Foreseeable misuse ignored
• Impact assessment kept separate from the risk assessment

Related units

• Impact assessment in operation
• The impact assessment process
• Context and the role you play