Control A.5.3: Documentation of AI system impact assessments
Record what each AI system impact assessment finds and retain those records for a set period.
What control A.5.3 asks
Record what each AI system impact assessment finds and retain those records for a set period.
Why it matters for privacy
An assessment nobody can find is an assessment that did not happen. The record has to survive the project, the reorganisation and the supplier change.
Where the draft lands: the evidence of evaluation. Evaluation is only demonstrable through its record. The draft's mechanism has to leave something an assessor can read.
Basis for A.5.3: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The public record supports the point at the level of the abstract; the draft text is not public. Evaluating the consequences.
Evidence for control A.5.3
These are the records that turn the control from a statement into something checkable. For control A.5.3 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Impact assessment Impact assessment records covering intended use and foreseeable misuse, positive and negative impacts, predictable failures and mitigations, relevant demographic groups, system complexity, the human role and oversight, and employment and skills effects
- Impact assessment Retention schedule for assessments
Where control A.5.3 commonly fails
- Assessments overwritten with no history
- No defined retention period
What to do about control A.5.3 before the draft lands
Keep each assessment with its date, version, author, approver, the data considered and the decision. Make it available to the privacy lead, the auditor and the affected business owner.
The certificate, if you hold one, is against ISO/IEC 42001:2023. Control A.5.3 is where the privacy work lands, and it is auditable before the draft is published.
Read across from control A.5.3
- Control A.5.2, AI system impact assessment process
- Control A.5.4, Assessing AI system impact on individuals or groups of individuals
- Control A.5.5, Assessing societal impacts of AI systems
← Control A.5.2 | Control A.5.4 →
Open the full index. The public record behind control A.5.3 shows the scope and the lifecycle.
Read control A.5.3 against ISO/IEC 42001:2023, Annex A, at the standards library. The overlay is ours, from the public record; nothing here is the draft text. Every source.