Control A.5.5: Assessing societal impacts of AI systems
Evaluate and record the possible effects of the organization's AI systems on society over their life cycle.
What control A.5.5 asks
Evaluate and record the possible effects of the organization's AI systems on society over their life cycle.
Why it matters for privacy
Some privacy harms land on a group rather than a person: a community whose records trained a model, a group whose behaviour is inferred. The societal assessment is where that is considered.
Where the draft lands: the wider consequence. The abstract does not limit the consequences to individuals. The evaluation it describes can include effects on groups and society.
Basis for A.5.5: the ISO page 56582 and the ISO/IEC 42001:2023 control record. No draft requirement is stated here: the abstract gives the direction and the text is not public. Evaluating the consequences.
Evidence for control A.5.5
The list below is what a reviewer will want produced, not described. For control A.5.5 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Impact assessment Societal impact assessment covering environmental sustainability, economic effects, government and democratic processes, health and safety, and norms and culture
- Impact assessment Analysis of misuse potential and reinforcement of historical bias
- Impact assessment Link to environmental sustainability goals
Where control A.5.5 commonly fails
- Environmental footprint of AI omitted
- Misuse scenarios such as misinformation not analysed
What to do about control A.5.5 before the draft lands
Add a societal section to the assessment for systems that profile, rank or infer at scale. Name the group, the inference, the possible effect and who was consulted.
Do not rebuild around a draft. Control A.5.5 already requires the evidence above, and the privacy preparation is the same control applied to the personal data an AI system touches.
Read across from control A.5.5
- Control A.5.2, AI system impact assessment process
- Control A.5.3, Documentation of AI system impact assessments
- Control A.5.4, Assessing AI system impact on individuals or groups of individuals
← Control A.5.4 | Control A.6.1.2 →
Open the full index. The public record behind control A.5.5 shows the scope and the lifecycle.
Control A.5.5 is cited to ISO/IEC 42001:2023, Annex A. The requirement, evidence and gaps are our wording from the control record; the privacy overlay is read from the ISO page and its abstract. The full list.