This step separately examines the impact on people and society of AI with large risk (13 points or more). Its purpose is to decide whether to approve use and what conditions to attach. You receive the impact assessment report and an overall judgment.
The impact of high-risk (13 points or more) AI systems on individuals, groups and society is assessed in seven areas: safety, fairness, transparency, personal information, security, human oversight, and society and environment. Based on the result, approval, conditional approval or hold and the deployment conditions are decided.
Output
- AI system impact assessment report: for each of the seven areas, High / Medium / Low, grounds, affected people and groups, mitigation measures
- Overall judgment (approval, conditional approval, hold) and deployment gate conditions
- Stakeholder notification and opinion collection plan
What to do in this step, by scope of application
| Development | Supply | Use |
|---|---|---|
| The impact of the developed model on end users and subjects, and how to reduce it through design | The impact on customers and their interested parties, and explanation of use and notice of limitations | The impact of AI output on employees and customers, and the points where a person checks |
Basis of the impact assessment: chosen by the customer
| 1) Import risk assessment results | 2) Upload a folder or file |
|---|---|
| Projects of 13 points or more are selected from the Step 5 AI risk assessment results (kept in this browser) or from a pasted risk assessment table and assessed for impact. A risk assessment made in eiso is a draft before approval, so the head of the report is marked "finalized after approval". Supplementary material such as bias and performance test results can also be specified together as a folder or file. | Specify a folder or file containing the risk assessment table and AI system material (purpose, data, model, test results, stakeholder opinions) on your company's computer. It is read only inside the browser and is not stored. The list of files read is written at the front of the report, and if no risk assessment result (risk level) is found, risk assessment is advised first. |
Start gate and reassessment
- The start targets are all significant risks (13 points or more: high 13 to 19 · critical 20 to 25) in the Step 5 risk assessment results for each AI in the Step 4 AI system inventory. Even if none is 13 points or more, at least 1 of the highest risks is assessed as a preliminary impact assessment, and an AI not assessed also has its judgment and reason recorded in the inventory reconciliation table.
- Even below 13 points, if any one of safety (human body, facilities), decisions about people such as recruitment or evaluation, mass processing of personal information, or external customer exposure applies, "risk assessment score review recommended" is given instead of an impact assessment. If the review result is 13 points or more, the assessment starts.
- Reassessment: significant changes such as a change or retraining of the supplier's model or a change of data source or use, a related AI incident, and periodically (high risk at least once a year). Risk reassessment and impact assessment reassessment are distinguished.
Impact level criteria: magnitude, scope, reversibility
| Factor | High | Medium | Low |
|---|---|---|---|
| Magnitude | Harm to life or body, deprivation of opportunities or rights such as in recruitment or evaluation, legal sanctions, distortion of financial reporting or disclosure | Loss of money or time, correctable disadvantage, error in internal decision-making | Minor inconvenience, resolved by immediate checking |
| Scope | Many external parties, the whole company, repeated for a specific group | Department or site | Individual or a few people |
| Reversibility | Unrecoverable or cannot be corrected afterwards (accident, confirmed rejection, disclosure) | Can be corrected with considerable effort | Can be corrected immediately |
Judgment rules: (1) if magnitude is "High", that area is "High" (serious adverse impact); (2) otherwise, if two or more of the three factors are "High", it is "High"; (3) if all three factors are "Low", it is "Low"; (4) all others are "Medium". An area with no impact is "Low (not applicable)" with a one-line reason, and when in doubt the higher level is chosen (conservative). If your company has no approved criteria, it is marked "(draft criteria)". The seven areas are safety · fairness · transparency and explainability · personal information · security · human control and oversight · impact on society and environment.
Overall judgment, approval and output
- ApprovalAll areas are "Medium" or below and the mitigation measures can be carried out during operation
- Conditional approvalOne or more areas are "High": deploy after confirming that mitigation measures for those areas have been carried out (deployment gate)
- HoldA "High" area has no mitigation measures, the residual impact is still "High" after measures, or required information (data, model, assessment team) could not be obtained. If already in operation, restriction or suspension of operation is considered
- Approver (example)High = AI risk management officer, critical = top management. If your company has its own rules, follow them.
- Output (for each project)System overview · system information (ISO/IEC 42005: intended use · unintended use · reasonably foreseeable misuse · data · model · deployment environment · direct and other stakeholders · vulnerable groups · benefits) · results for each of the seven areas · residual impact and feedback to the risk assessment (reflection of new risks and treatment plans) · overall judgment, deployment gate and approval field; a summary table if there are several.
Grounds: ISO/IEC 42001:2023 6.1.4, 8.4, Annex A.5 (impact assessment); ISO/IEC 42005:2025 (AI system impact assessment: timing, responsibility, performance, analysis of results, recording, approval, monitoring; system, data, model, deployment environment, stakeholders, benefits and harms, measures). Judgment and approval are made by the person responsible designated by your company.
Next steps
Previous steps: 5 AI Risk Assessment · 4 AI System Inventory · 1 AI Context Analysis · 11 Monitoring, Change and Revision Control · 14 Management Review · 16 Improvement · 10 Documented Information Control · The output of this step is carried forward in: 2 AI Policy, Roles and Objectives · 7 Control Implementation and Statement of Applicability (SoA) · 8 Verification and Use Approval · 9 Operational Control · 10 Documented Information Control · 11 Monitoring, Change and Revision Control
