Clause 6.1.4 asks for an assessment of what an AI system could do to people, and it is a separate requirement from your risk assessment. The screening section at the top means a low-risk tool takes two minutes to dismiss with a reason on record, and only the systems that genuinely affect people get the full four stages.

Effective Form Templates

This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Form number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary fields. Simple and usable form templates developed over 25 years through practical use in the real world. No AI generated nonsense here!

Further Reading

Further guidance on assessing the impact of AI on people:

• ISO 42001 Clause 6.1 - Actions to Address Risks and Opportunities
• ISO 42001 Clause 4.2 - Needs and Expectations of Interested Parties
• ISO 42001 Annex A Controls

Logo Update Service *

Download this form template with your company name and logo already added!
Document Preparation available with all document toolkits.

How to Download

To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This form is also included in the ISO 42001 Toolkit.

Need Help Implementing?

If you'd like hands-on help working through impact assessments for the AI systems you use, or setting up your wider AI management system, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

AI Impact Assessment Form Template

The AI system impact assessment required by ISO 42001 - a structured record of the potential consequences of an AI system for individuals, groups and society, with a screening step so the effort goes where it matters.

Clause 6.1.4 is explicit that this assessment is required, and it is distinct from the AI risk assessment. Risk assessment asks what could go wrong for the organisation. Impact assessment asks what the system could do to the people it touches. This form covers the second, and feeds the resulting risks into the register.

Built for ISO 42001 clause 6.1.4

The form is written around what the clause actually asks for:

• Consequences for individuals, groups and society assessed on a risk basis
• Intended use and foreseeable misuse both considered, across the life cycle
• Applicable jurisdictions recorded, so obligations in the markets served are visible
• Human oversight arrangements recorded wherever automated decision-making affects people
• An outcome, conditions of use and a next review date, so the assessment stays current

What's Included in this AI Impact Assessment

A header recording the AI system, applicable jurisdictions, the reason for assessment and who completed it, then:

• Screening - six questions determining whether a full assessment is needed. If every answer is no and the use is incidental and low-risk, the outcome is recorded as not required with a brief reason. Automated decision-making affecting people always requires the full assessment
• Stage 1 - Use of the AI system - where, how and why it is used, through which process or function, and the provider, model and version
• Stage 2 - Who is affected - customers, employees, applicants and service users, with vulnerable groups and people with protected characteristics noted explicitly
• Stage 3 - How they are affected - potential impacts across the life cycle from intended use and foreseeable misuse, prompting on fairness and bias, privacy, transparency and the ability to question a decision, human autonomy, safety and wellbeing, access and inclusion, legal and human rights, and societal and environmental effects
• Stage 4 - Controls, residual impact and human oversight - the mitigations in place or required, whether the residual impact is acceptable, and the named reviewer and trigger conditions where automated decisions affect people
• Outcome and sign-off - proceed, proceed with conditions or do not proceed, conditions and restrictions, whether AI use is disclosed to interested parties, the next review date and AI lead approval

Who Needs an AI Impact Assessment?

Any organisation using AI where the output reaches a person - a customer, an employee, an applicant or the public. It is a requirement for ISO 42001 certification, and it is increasingly the document asked for in customer due diligence and by anyone assessing obligations under emerging AI regulation. It is also the assessment that gives you a defensible reason for not adopting an AI tool.

Included in the ISO 42001 Toolkit

This form is part of the ISO 42001 Toolkit - the policies, procedures, registers, audit checklists and guidance for running an AI management system in one download. The other three AI forms are listed on the F-AI forms page.

Pairs with the AI Risks and Controls Register

The impact assessment identifies what could happen to people. The risks that follow, their scoring and the Annex A controls applied are recorded on the ER42 AI Risks and Controls Register, so the assessment feeds the register rather than repeating it.