Impact on individuals and groups

The requirement, in our words

Evaluate and record how the system could affect individuals or groups over its life cycle, covering human rights, accessibility, financial consequences, health and safety, privacy and security, explainability, accountability and fairness, and considering vulnerable groups.

What it means for human oversight

The overseer needs the specific impact, not a category. Name the vulnerable groups, the decision at stake and the harm that would show the system is wrong.

How to evidence it

Attach the artefacts above to the Impact on individuals and groups row with the system name, the owner and the date. The first one is the anchor: An individual and group impact assessment across the listed dimensions. The OH-22 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Consideration of vulnerable groups. If that artefact for OH-22 cannot be produced, the row is a gap, whatever the policy says.

OH-22 carries 3 evidence items and 2 common gaps. For impact on individuals and groups, link the row to the assessment page that names the harm, because an overseer cannot watch for a consequence the file never describes. The OH-22 statement above is ours, written from ISO/IEC 42001:2023, A.5.4, not a reproduction of the licensed text.

Common gaps

• Vulnerable groups not considered
• Only privacy impacts assessed

Related units

• Impact assessment at planning
• Impact assessment in operation
• Context and the role you play