AI Impact Assessments Need Clear Owners

AI impact assessments become a structured lifecycle process under ISO/IEC 42005:2025. A new AWS article shows how the standard can connect with existing enterprise risk management and an AI management system based on ISO/IEC 42001.

More than a document before go-live

ISO describes impact assessment as a process for identifying and addressing possible consequences for individuals, groups and society. It covers planning, development, operation, monitoring and retirement. The assessment is therefore not a one-time approval PDF, but a recurring control process.

AWS highlights two roles. An owner is accountable for the assessment and its results. A facilitator organizes workshops, involves relevant functions and documents assumptions, risks, benefits and treatments. In a small organization, one person may hold both roles, but accountability should still be explicit.

What companies should define

A workable process needs at least five decisions:

• Trigger: Which new use, data class or model change starts an assessment?
• Affected parties: Which people, groups and business processes may experience benefits or harm?
• Evidence: Which tests, complaints, operational data and expert judgments are considered?
• Treatments: Which controls reduce risk, and who implements them by when?
• Approval: Who accepts residual risk, monitors indicators and can stop the system?

The European Commission also points to the fundamental rights impact assessment under Article 27 of the AI Act. It applies, among others, to public bodies, private entities providing public services and certain high-risk credit and insurance uses, and must be performed before first use.

The operating model matters in DACH

DACH organizations should avoid creating a duplicate process. Data protection impact assessments, information security, supplier reviews, works councils and business approvals already provide evidence. The AI impact assessment should connect these results, expose gaps and produce a clear business decision.

Do not start with a long template. Start by defining the owner, triggers, decision body and review cycle. The value of an impact assessment is not its page count. It is the organization’s ability to connect risks, controls and approvals throughout operations.