Control A.5.4: Assessing AI system impact on individuals or groups of individuals
Evaluate and record how AI systems could affect individuals or groups of individuals over the system's life cycle.
What control A.5.4 asks
Evaluate and record how AI systems could affect individuals or groups of individuals over the system's life cycle.
Why it matters for privacy
The impact on an individual is specific: a refusal, a price, a flag, a delay, an exposure. The assessment has to reach that level or it is a description of the system, not its consequences.
Where the draft lands: consequences for people. The abstract is about privacy risk, which is risk to people. This control asks the question in the same terms.
Basis for A.5.4: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. Evaluating the consequences.
Evidence for control A.5.4
This is the evidence an auditor or a privacy reviewer asks to see. For control A.5.4 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Impact assessment Individual and group impact assessment covering human rights, accessibility, financial consequences, health and safety, privacy and security, explainability and transparency, accountability and fairness
- Impact assessment Consideration of vulnerable groups such as children, elderly or impaired persons and workers
- Impact assessment Records of expert consultation where needed
Where control A.5.4 commonly fails
- Vulnerable groups not considered
- Only privacy impacts assessed
What to do about control A.5.4 before the draft lands
For each affected group, describe the decision or output, the harm if it is wrong, the likelihood, the severity and the control that reduces it. Include the people who never interact with the system but appear in its data.
The requirement for control A.5.4 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.5.4
- Control A.5.2, AI system impact assessment process
- Control A.5.3, Documentation of AI system impact assessments
- Control A.5.5, Assessing societal impacts of AI systems
← Control A.5.3 | Control A.5.5 →
Open the full index. The public record behind control A.5.4 shows the scope and the lifecycle.
Source for control A.5.4: ISO/IEC 42001:2023, Annex A, retrieved 22 October 2026, at the standards library. The overlay rests on the public 27091 record. Every source.