Control A.5.2: AI system impact assessment process
Put in place a way of assessing what an AI system could mean for individuals, groups of individuals and societies across its life cycle.
What control A.5.2 asks
Put in place a way of assessing what an AI system could mean for individuals, groups of individuals and societies across its life cycle.
Why it matters for privacy
An impact assessment process is the mechanism the draft describes in outline: evaluate the consequences before you accept them. The process is what makes it repeatable rather than personal.
Where the draft lands: the evaluation mechanism. The abstract asks for the consequences of privacy risk to be weighed. This control is the mechanism already in force for doing it.
Basis for A.5.2: the ISO page 56582 and the ISO/IEC 42001:2023 control record. No draft requirement is stated here: the abstract gives the direction and the text is not public. Evaluating the consequences.
Evidence for control A.5.2
The list below is what a reviewer will want produced, not described. For control A.5.2 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Impact assessment Impact assessment procedure stating triggers (criticality of purpose, complexity and automation, data sensitivity, significant changes)
- Impact assessment Process steps: identification, analysis, evaluation, treatment, documentation and communication
- Impact assessment Named assessors and the way results inform design or use
Where control A.5.2 commonly fails
- No defined triggers, so assessments are optional
- Assessment results never feed design decisions
What to do about control A.5.2 before the draft lands
Define when an assessment is required, who runs it, who approves it, what it must cover and when it is repeated. Include a change of purpose and a new data source as triggers.
Do not rebuild around a draft. Control A.5.2 already requires the evidence above, and the privacy preparation is the same control applied to the personal data an AI system touches.
Read across from control A.5.2
- Control A.5.3, Documentation of AI system impact assessments
- Control A.5.4, Assessing AI system impact on individuals or groups of individuals
- Control A.5.5, Assessing societal impacts of AI systems
← Control A.4.6 | Control A.5.3 →
Open the full index. The public record behind control A.5.2 shows the scope and the lifecycle.
The record behind control A.5.2 is the ISO/IEC 42001:2023 Annex A set, retrieved 22 October 2026. The public 27091 abstract supplies the privacy direction, not a draft requirement. Check the sources.