The impact assessment process

The requirement, in our words

Put in place a way of assessing what an AI system could mean for individuals, groups and society across its life cycle, with triggers for when an assessment is required and steps for identification, analysis, evaluation, treatment and communication.

What it means for human oversight

The process should state who assesses, who reviews and how the result reaches the operator. A process that stops at a document never changes what the person at the screen does.

How to evidence it

Attach the artefacts above to the The impact assessment process row with the system name, the owner and the date. The first one is the anchor: An impact assessment procedure with triggers. The OH-21 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for The process steps and named assessors. If that artefact for OH-21 cannot be produced, the row is a gap, whatever the policy says.

OH-21 carries 3 evidence items and 2 common gaps. For the impact assessment process, link the row to the assessment page that names the harm, because an overseer cannot watch for a consequence the file never describes. The OH-21 statement above is ours, written from ISO/IEC 42001:2023, A.5.2, not a reproduction of the licensed text.

Common gaps

• No defined triggers, so assessments are optional
• Results never feed design decisions

Related units

• Impact assessment at planning
• Impact assessment in operation
• Context and the role you play