---
title: "ISO 42005 turns AI impact assessment into evidence, not a risk-register checkbox"
description: "AWS's mapping to ISO/IEC 42005 shows the practical shift: AI impact assessment must connect intended use, affected parties, measured impacts and treatment decisions. Governance teams need an evidence trail, not another static register."
url: "https://devencelab.com/insights/2026/10/06/iso-42005-turns-ai-impact-assessment-into-evidence-not"
date: "2026-10-06"
section: "Insights"
tag: "AI Regulation"
author: "Devence Lab"
reading_time: "2 min read"
site: "Devence Lab"
license: "Readable and quotable with attribution to the canonical URL."
---

# ISO 42005 turns AI impact assessment into evidence, not a risk-register checkbox

AWS's mapping to ISO/IEC 42005 shows the practical shift: AI impact assessment must connect intended use, affected parties, measured impacts and treatment decisions. Governance teams need an evidence trail, not another static register.

ISO/IEC 42005:2025 was published in May 2025 as guidance for organisations performing AI system impact assessments. AWS's 6 October mapping of its governance services to the standard makes the operational implication clearer: an assessment is not a single risk score. It is a documented chain from intended use and affected parties to observed impacts, treatment decisions and continuing review.

## The assessment boundary is the first control

AWS describes the process as defining scope, identifying affected individuals and groups, assessing positive and negative impacts, documenting mitigations, and monitoring outcomes. That sequence matters because model-level testing cannot answer every system-level question. A model may pass technical evaluations while the deployed workflow changes access to a service, exposes personal data or shifts a consequential decision to an automated process.

ISO's own description says the standard provides guidance for organisations that develop, provide or use AI systems to conduct impact assessments and document their results. The standard is guidance rather than a universal pass-fail certification test. The evidence still has to reflect the organisation's actual context.

> An AI impact assessment is useful only when another reviewer can reconstruct why the system was allowed to operate.

## Tooling can collect evidence; it cannot own the judgement

AWS points to services including SageMaker Model Cards, SageMaker Clarify, Amazon Bedrock Guardrails and AWS Audit Manager as components that can support documentation, evaluation and control evidence. That is a useful implementation pattern, but the mapping should not be mistaken for automatic conformity with ISO/IEC 42005.

The difficult decisions remain organisational: which stakeholders count as affected parties, which impacts are material, what evidence is sufficient, who accepts residual risk and what change requires reassessment. Cloud controls can preserve measurements and approvals. They cannot decide whether a business impact is acceptable.

## Build a reassessment trigger, not a one-time form

Governance teams should turn the assessment into a versioned record linked to the deployed system. Capture intended purpose, owners, affected groups, data classes, evaluation results, known limitations, mitigations, residual-risk acceptance and the evidence behind each conclusion. Assign each material claim an owner and review date.

Then define change triggers. A new model version, new data source, broader user population, additional tool permission or material change in decision authority should reopen the assessment. That creates a control that follows the system rather than a document that expires quietly after launch.

AWS's mapping is most useful as an implementation example, not as proof that a workload complies. ISO/IEC 42005 raises the standard of evidence: teams should be able to show what they assessed, whose impacts they considered, what changed because of the assessment and why the remaining risk was accepted.

Produced through Devence Lab's automated research and publishing workflow, without prepublication human review. Devence Lab retains editorial responsibility. Sources are linked; report factual errors to contact@devencelab.com.

## Sources

- [Responsible AI governance: How AWS positions customers to align with ISO/IEC 42005:2025](https://aws.amazon.com/blogs/machine-learning/responsible-ai-governance-how-aws-positions-customers-to-align-with-iso-iec-420052025/) - AWS
- [ISO/IEC 42005:2025 — Artificial intelligence — AI system impact assessment](https://www.iso.org/standard/44545.html) - ISO