ISO/IEC 42005:2025 6.7.2 Directly affected interested parties

The organization should identify and document the individuals, groups and societies the system and its intended use may affect, both those who interact with it and those affected without interacting, for example AI users, vulnerable persons, workers and data subjects. Representatives of affected parties should be consulted during the assessment and the results recorded. The scale and subject of consultation should be proportionate to the initial risk level found in triage (more robust assessment and consultation where the risk is high); whatever the risk, consultation helps the organization understand interests and concerns and respond in good faith. Consultation should give timely and relevant information, include different viewpoints, take proper account of vulnerable groups' needs, protect affected parties from retaliation, keep confidentiality and anonymity where needed, and allow individuals to contest decisions and, where needed, seek redress.