iso42001

Provide your organization role (AI provider, user, or both), the AI systems in scope, and current documentation. The skill assesses Clauses 4-10 and Annex A controls, returning a table with requirement, RAG status, evidence needed, and a prioritized remediation roadmap.

The AISIA is a mandatory Clause 6.1.2 assessment of an AI system's impacts on individuals and society. It evaluates intended purpose, affected populations, severity, and reversibility, then classifies impact as Low, Medium, or High to drive control selection.

Annex A contains 38 controls across nine domains (A.2 through A.10), covering AI policy, internal organization, resources, impact assessment, lifecycle, data, transparency, responsible use, and third-party relationships. Applicability depends on whether you are an AI provider or user.

Yes. ISO 42001 applies to both AI providers and AI users. AI users focus on controls like A.9 responsible use, A.10.3 supplier assessments, and A.6.2.6 monitoring, while provider-specific controls like A.7 data governance may be less applicable.

Stage 1 requires the AIMS scope document, signed AI policy, AI system register, completed AI risk assessments and AISIAs, Statement of Applicability, measurable AI objectives, internal audit programme, and management review agenda.

The ISO 42001 AISIA aligns closely with the EU AI Act's Fundamental Rights Impact Assessment for high-risk systems. Organizations can extend their 42001 assessments to cover FRIA requirements, and certification may support EU AI Act conformity efforts.