ISO/IEC 42005:2025 · ISO/IEC 42001 · EU AI Act Articles 27 and 50
AI Impact Assessment, One System at a Time
An AI impact assessment asks what your system does to the people it acts on. ISO/IEC 42001 requires a documented process for it, ISO/IEC 42005: 2025 sets out the method, and the EU AI Act adds two separate duties that most programs fold into the same document by mistake. The Elevate AI Impact Assessment Checklist runs one system through the whole thing: eleven sections, 57 checks, each carrying the clause it answers to.
11
57
2 Dec
No-cost
WHY IT MATTERS NOW
The AI impact assessment obligation did not move. One of the two EU duties did.
Article 50 transparency applies now
The Digital Omnibus on AI left Article 50 out of its deferral. Transparency duties for interactive and generative systems, chatbot disclosure, synthetic content marking and deepfake labelling, have applied and been enforceable by national market surveillance authorities since 2 August 2026. They apply regardless of risk tier, which is why they reach organizations that do not think of themselves as AI companies at all. Synthetic media systems already on the market before that date carry a transition grace period to 2 December 2026 for the machine-readable marking requirement under Article 50(2).
Article 27 and the high-risk regime
The standalone Annex III high-risk obligations, and the Article 27 fundamental rights impact assessment that tracks them, were deferred to 2 December 2027, with product-embedded systems following in 2028. That is headroom to build the assessment properly, not permission to skip it. Teams that filed the whole regulation under next year are the ones carrying a live Article 50 obligation without knowing it.
Ten stakeholder groups
Programs written from a framework document rather than from discovery produce controls nobody operates. The board, model risk and procurement each hold part of the picture and none of them holds all of it.
ISO/IEC 42001 clause 6.1.4
The AI system impact assessment is a requirement of the management system itself, not of any regulation. If you are pursuing ISO 42001 certification, an auditor will ask for the documented process and the completed assessments regardless of where your systems sit under the EU AI Act. This is the artifact most programs postpone until that question arrives.
WHAT IS INSIDE
Eleven AI impact assessment sections, 57 checks, each tied to its clause
Tick a box only when the item is documented and current, not merely intended. Every unticked box is a gap. Sections one to nine are the ISO 42001 and ISO 42005 assessment, 44 checks. Sections ten and eleven are the EU AI Act cross-checks, 13 checks, kept deliberately separate because completing the assessment does not complete them.
SECTION 01 · 7 CHECKS
Set up the assessment
A documented process integrated with your existing risk, governance and change management, with timing defined at planning, before deployment, at significant change and on a review cadence.
SECTION 02 · 5 CHECKS
Describe the AI system
Name, version, owner, where it sits, what it does, the problem it solves, its intended uses and the out-of-scope uses you have identified, including reasonably foreseeable misuse.
SECTION 03 · 5 CHECKS
Data
Sources, provenance and lawful basis, personal or sensitive data classified, quality documented, representativeness and bias evaluated, retention and deletion controls in place.
SECTION 04 · 4 CHECKS
Algorithms and models
The algorithms in use including third-party components, model type and training approach, a traceable change history, and explainability assessed for the audience that has to act on the output.
SECTION 05 · 4 CHECKS
Deployment environment
Geographies and languages, the jurisdictions and regulatory requirements that follow from them, technical constraints, and the integration points the system feeds or depends on.
SECTION 06 · 4 CHECKS
Affected interested parties
Who the system acts on, including vulnerable groups and people who cannot easily challenge a decision, plus a channel for them to raise a concern.
MON
Monitoring and performance
Drift, degradation, and the thresholds that trigger action rather than a report.
TPR
Third-party and supply chain
Vendor AI, embedded features, and the contractual terms that determine what the bank can actually verify.
SEC
AI security
Adversarial exposure, prompt injection, model and data protection, and where AI systems sit relative to the bank’s security perimeter.
SECTION 07 · 6 CHECKS
Impacts: benefits and harms
Benefits and harms identified, each rated for severity and likelihood against defined criteria, failure modes assessed, foreseeable misuse assessed. The section regulators read first.
SECTION 08 · 5 CHECKS
Measures to address harms and benefits
A named owner for each mitigation, human oversight measures defined, residual risk documented and formally accepted by the right authority, results fed into risk treatment rather than filed.
SECTION 09 · 4 CHECKS
Record, approve, and keep it current
A controlled, versioned record, reported to the right parties, formally approved and signed off, with a review cadence and defined re-assessment triggers.
CROSS-CHECK 10 · 7 CHECKS
Fundamental rights impact assessment
The seven Article 27 elements, and the prior question of whether Article 27 reaches you at all. A separate, deeper obligation for certain deployers of high-risk systems, not a section of the assessment above, and one that has to be completed before the system is put into use.
CROSS-CHECK 11 · 6 CHECKS
EU AI Act transparency obligations
Two provider checks (direct interaction, synthetic content marking), three deployer checks (emotion recognition and biometric categorisation, deepfakes, published AI-generated text), and one that applies to both: disclosures clear, accessible, and accounting for children.
Three steps to a defensible AI impact assessment
Enter your work email and we send the checklist as a working document. One system per checklist, because an impact assessment is system-level rather than a program-level review.
Download the checklist
This is cross-functional: product, data, security, legal and compliance. Tick a box only when the item is documented and current, not planned or intended.
Run it with the right people
Bring the section with the most unticked boxes. We map the gaps against ISO 42001 and the ISO 42005 method, tell you whether Article 27 reaches you, and hand back the close-out order.
Book the no-cost review
Get the checklist
Run one AI system through a complete impact assessment.
Enter your work email and we will send the Elevate AI Governance Intake Questionnaire for Banks: 136 questions, 10 stakeholder groups, 13 control domains, each anchored to a CRI FS AI RMF control objective.
- 57 checks across the full ISO 42005 assessment method
- The clause each section answers to, section by section
- Where a FRIA starts and this assessment stops
- Article 50 duties, live now, with a marking grace ending 2 December
- A no-cost 30 minute review of your completed checklist
THE REVIEW
What your no-cost AI governance review covers
Thirty minutes with the practitioners who run these assessments. Bring the completed checklist, or bring the one section you could not finish. A half-finished checklist is still a diagnosis.
Your gaps, read against the standards
We take your unticked boxes section by section and separate the ones that block an ISO 42001 audit from the ones that are good practice. Not every gap is urgent, and knowing which is which is most of the value.
Whether Article 27 reaches you at all
The FRIA trigger is narrow and specific. We walk your deployment against it and tell you plainly whether you are in scope, so you are not building an obligation you do not carry or missing one you do.
The close-out order, with owners
You leave with the gaps sequenced: what to fix before the system ships, what to fix before the audit, and what connects into the ISO 27001 and privacy evidence you already hold. You do not have to track which standard version applies. We track that.
Who you meet. The review is run by Elevate’s AI governance practice, led by Angela Polania, an ISO 42001 Lead Auditor. The practice runs ISO 42001 impact assessments, EU AI Act readiness reviews, and integrated ISO 27001 and privacy programs, so the assessment connects to the management system you are actually building rather than standing beside it.
BUILT FROM THE RULESET
AI impact assessment written against the standards, not around them
The checklist operationalizes the requirements of ISO/IEC 42001, the method of ISO/IEC 42005:2025, and Articles 27 and 50 of the EU AI Act. Every section carries the clause it answers to, so the evidence you produce is traceable to the requirement that demanded it rather than to a template.
It also draws the boundary most guidance blurs. A fundamental rights impact assessment is a separate obligation reserved for certain deployers of high-risk AI systems, and Article 50 transparency is a disclosure duty rather than an assessment step. That is why sections ten and eleven sit outside the assessment rather than inside it. Treating all three as one exercise is why organizations arrive at an audit with a document that satisfies none of them.
Where an ISO 27001 information security management system already holds the data protection, access and logging controls behind section three, the checklist says so rather than asking you to rebuild evidence you have. What ISO 27001 does not provide is the impact judgment: whether a given effect on an affected party is acceptable, and who accepted it.
57
3
+18
100%
AUDIENCE
Who this AI impact assessment checklist is for
Teams pursuing ISO 42001 certification
The AI system impact assessment is a requirement of the management system, and it is the artifact most programs postpone until an auditor asks for it.
Anyone running interactive or generative AI
Article 50 applies now, regardless of risk tier. Section eleven is the shortest route to knowing whether you are already carrying a disclosure duty you have not met.
Product and engineering leads
Sections two through six ground the assessment in the actual system, data and people. Without them the assessment describes something that does not exist.
Legal, privacy and compliance
Where a DPIA already covers part of this, the two connect rather than duplicate. The checklist marks where, so the work is done once.
An AI impact assessment is only useful once its gaps get closed
Take the section with the most unticked boxes, bring it to a no-cost review, and we map the gaps against ISO 42001, the ISO 42005 method, and whether Article 27 reaches you at all. If you already know where your gaps are, skip the checklist and take the review.
QUESTIONS
AI impact assessment: frequently asked questions
What is ISO 42005?
ISO/IEC 42005:2025 is the guidance standard for AI system impact assessment. ISO/IEC 42001 requires an organization to have a documented impact assessment process as part of its AI management system; ISO 42005 sets out how to perform the assessment and what it should contain. The two work together: 42001 creates the obligation, 42005 supplies the method. The checklist carries the clause reference for both against every section, so the evidence you produce is traceable to the requirement it answers rather than to a template.
Is an AI impact assessment the same as a FRIA?
No, and the distinction matters. A fundamental rights impact assessment under Article 27 of the EU AI Act is a separate obligation reserved for certain deployers of high-risk AI systems: bodies governed by public law, private entities providing public services, and deployers of Annex III systems for creditworthiness and credit scoring or for risk assessment and pricing in life and health insurance. Completing an ISO 42005 style impact assessment gives you some inputs a FRIA reuses, but it does not satisfy Article 27. It is also a pre-deployment instrument: where it applies, it has to be completed before the system is put into use. Section 10 of the checklist is the cross-check that tells you whether Article 27 reaches you at all.
How does this relate to a data protection impact assessment?
They overlap without being interchangeable. A DPIA asks whether personal data processing is lawful and proportionate. An AI impact assessment asks what the system does to the people it acts on, which is a wider question that reaches effects with no personal data in them at all. Where a DPIA already covers part of the ground, the checklist marks the point so the evidence is shared rather than rebuilt. If the system processes personal data, coordinate the two rather than running them separately.
Is Article 50 transparency part of the impact assessment?
No. It is a transparency obligation rather than an assessment step, and it is in the checklist because it is the EU AI Act duty most systems trigger and most programs overlook. Article 50 applies now and has been enforceable by national market surveillance authorities since 2 August 2026. It was not deferred when the high-risk obligations moved, and it applies regardless of risk tier. Synthetic media systems already on the market before 2 August 2026 have a transition grace period to 2 December 2026 for the machine-readable marking requirement under Article 50(2).
Did the EU AI Act delay remove the pressure?
It moved one obligation and left another in force. The Digital Omnibus on AI deferred the standalone Annex III high-risk obligations, and the Article 27 FRIA that tracks them, to 2 December 2027, with product-embedded high-risk systems following in August 2028. Article 50 transparency was left out of that deferral entirely and has applied since 2 August 2026. Teams that filed the whole regulation under next year are carrying a live obligation, not a deferred one.
How often should the assessment be re-run?
At each significant change and on a set review cadence, not once. An assessment describing a system that has since been retrained, repurposed, or redeployed into a different context is evidence of nothing, and version discipline on the record is part of what makes it defensible later. Section 9 of the checklist covers the controlled record, the approver and the re-assessment triggers.
What if we already run ISO 27001?
The two connect but do not overlap. An ISO 27001 information security management system typically already holds the data protection, access and logging controls behind the data section, so that evidence is shared rather than rebuilt. What ISO 27001 does not provide is the impact judgment: whether a given effect on an affected party is acceptable, and who accepted it. The checklist marks the shared evidence so the work is done once.