Performing the assessment

The requirement, in our words

Carry out the assessment by identifying the reasonably foreseeable impacts on everyone affected, counting benefits as well as harms, estimating magnitude and likelihood, choosing a response and recording the input from affected parties.

What it means for human oversight

The assessment should produce the scenarios the overseer watches for: the wrong output, the vulnerable person, the misuse, the feedback loop. A list of abstract categories is not usable at the screen.

How to evidence it

Attach the artefacts above to the Performing the assessment row with the system name, the owner and the date. The first one is the anchor: Completed assessments with beneficial and adverse impacts. The OH-35 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Magnitude and likelihood estimates with the chosen response. If that artefact for OH-35 cannot be produced, the row is a gap, whatever the policy says.

OH-35 carries 3 evidence items and 3 common gaps. For performing the assessment, link the row to the assessment page that names the harm, because an overseer cannot watch for a consequence the file never describes. The OH-35 statement above is ours, written from ISO/IEC 42005:2025, 5.8, not a reproduction of the licensed text.

Common gaps

• Only adverse impacts considered, or only benefits
• Assessment done once late in the life cycle
• No input from affected communities

Related units

• Impact assessment at planning
• Impact assessment in operation
• Context and the role you play