ISO/IEC 42005:2025 5.7 Thresholds for sensitive and restricted uses

Documented thresholds, above all for how an AI system is used, are central to the process: the organization should set them for its own context, taking into account applicable law, the expectations of relevant interested parties, the current state of the art, the benefits the AI system brings, cultural, labour and societal norms, and the ethical frameworks for AI that apply. Depending on the kinds and number of thresholds it can add processes such as reviews and approvals; it may decide, for instance, that some uses, or some misuses that can reasonably be foreseen, count as sensitive or are forbidden by its policy, and law and other external requirements can also make a use sensitive. Where an assessment shows that a planned use is sensitive or restricted, the organization should record what the next steps in the overall process are. Automated credit decisions are given as an example of sensitive use because of their potential financial harm to individuals, and a system with a significant effect on human rights, particularly children's rights, whose harms cannot be removed by technical changes alone is given as a case to escalate to higher management, including on whether to redesign it. The organization should also decide how the overall scale of impact is set and how foreseeable impacts are measured, because a use that is not sensitive can still reach a very large population; it should weigh scale when shaping the assessment's components and set criteria for the types of impact an AI system can cause, for example ranking an impact as very severe when it can lead to significant adverse consequences for the organization, groups or societies.