Summary
- Published in May 2025 (Edition 1, 39 pages) by ISO/IEC JTC 1/SC 42; iso.org lists it as published and current (stage 60.60).
- Per the iso.org page (paraphrased): it guides organisations through AI system impact assessments, looking at how an AI system and its foreseeable uses could affect individuals, groups or society, and helps them identify, evaluate and document those impacts.
- iso.org says assessments should happen across the lifecycle, from design through deployment and post-market monitoring, and be updated when things change.
- iso.org positions it as a complement to ISO/IEC 42001 (management system), ISO/IEC 38507 (governance) and ISO/IEC 23894 (risk management), with its own focus on human and societal impact.
- Guidance only ("should" language). There is no separate 42005 certificate.
Who it applies to
- Nobody by law. iso.org describes the audience as any organisation that develops, provides or uses AI systems, of any sector or size.
- Not extraterritorial.
Key dates
- Companion risk guidance ISO/IEC 23894 published
- ISO/IEC 42001 published; it calls for AI system impact assessment
- ISO/IEC 42005:2025 (Edition 1, 39 pages) published; iso.org gives month only
Full date record
| Date | Event |
|---|---|
| 2023-02 | ISO/IEC 23894 (risk guidance) published |
| 2023-12-18 | ISO/IEC 42001 published |
| 2025-05 | ISO/IEC 42005:2025 published (iso.org gives month only) |
Penalties and enforcement
- None. It is voluntary and not certifiable on its own.
- Auditors of ISO/IEC 42001 may review how you run impact assessments; 42005 is a recognised way to structure them, but using it is a choice.
What it means for an Indian company
- Use it to build SC-AI-006 AI impact assessment (people and society): a repeatable template that records who is affected, what could go wrong for them, how likely and severe it is, and what you will do about it.
- Link the outputs to SC-AI-017 Fairness and discrimination testing of outputs and SC-AI-013 Data bias and representativeness checks (discrimination is a typical impact) and to SC-AI-027 Right to contest and human review for individuals (how affected people can push back).
- Indian personal data duties under the DPDP Act are separate; an AI impact assessment does not replace privacy compliance, but the two can share evidence.
- Exporters to the EU: impact thinking also helps with the fundamental rights impact assessment some deployers owe under EU AI Act, though 42005 is not an EU harmonised standard (see EU AI Act Harmonised Standards).
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when ISO/IEC 42005 is done.
Glossary
- AI system impact assessment: a structured look at the possible effects of an AI system on people and society, not just on the company.
- Foreseeable use: a way the system is likely to be used, including misuse the organisation could reasonably expect.
- ISO/IEC 38507: an ISO standard on how boards should govern the use of AI.
- Stage 60.60: ISO code for published and current.
Key takeaways
- Voluntary guidance for assessing AI impact on people and society; complements 42001 and 23894.
- The natural home for SecComply control SC-AI-006.
Official sources
- ISO/IEC 42005:2025 catalogue page (iso.org), accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.