Home / Rules / ISO/IEC 42001:2023
ISO/IEC 42001:2023: the rules AI agent steps rest on
- Edition
- ISO/IEC 42001:2023 (first edition, December 2023)
- Checked current
- 2026-10-07
- Official source
- https://www.iso.org/standard/42001
- Licence
- The standard is licensed: each rule is our statement of its clause, cited, never quoted.
| Rule | Our statement | Steps that cite it |
|---|---|---|
| ISO/IEC 42001:2023 6.1.4 AI system impact assessment | Set out how the organization will assess the possible consequences that developing, providing or using AI systems can have for individuals, groups of individuals and societies. The assessment must cover what could follow from deploying the system, from its intended use and from misuse that can reasonably be foreseen, take account of its technical and societal context and applicable jurisdictions, and be documented (results can be shared with interested parties where appropriate). Its results must feed the risk assessment of 6.1.2; the A.5 controls apply. | KC-06 S1 Is an impact assessment required, and when? |
| ISO/IEC 42001:2023 8.4 AI system impact assessment (operation) | Carry out AI system impact assessments on the 6.1.4 basis at scheduled intervals and whenever significant changes are proposed, and keep documented results of all of them. | KC-06 S1 Is an impact assessment required, and when?; KC-06 S6 The change request |
| ISO/IEC 42001:2023 Annex A.5.2 AI system impact assessment process | Put in place a way of assessing what an AI system could mean for individuals, groups of individuals and societies across its life cycle. | KC-06 S1 Is an impact assessment required, and when? |
| ISO/IEC 42001:2023 Annex A.5.4 Impact on individuals or groups | Evaluate and record how AI systems could affect individuals or groups of individuals over the system's life cycle. | KC-06 S3 Who is affected? |
| ISO/IEC 42001:2023 Annex A.6.2.4 Verification and validation | Set out in writing how the AI system will be verified and validated and the criteria that govern when each measure is used. | KC-06 S4 Before deployment |
| ISO/IEC 42001:2023 Annex A.6.2.5 Deployment | Document a deployment plan and make sure the appropriate requirements are met before deployment. | KC-06 S4 Before deployment |
| ISO/IEC 42001:2023 Annex A.6.2.8 Event logs | Decide in which life cycle phases the AI system records event logs, and make sure it does so at least while it is in use. | KC-06 S4 Before deployment |