The organization must formally conduct AI system impact assessments according to the process established during its initial planning (as per ISO 42001 section 6.1.4).

These impact assessments, which evaluate the system's effect on individuals and society, must be performed at two key intervals:

• At planned, scheduled times (e.g., annually or on another regular cycle).
• Whenever significant changes occur or are proposed to the AI system, its intended use, or its operational environment.

Following every assessment, the organization must create and maintain documented information recording the findings, analysis, and conclusions of the impact assessment process.

The organization should establish a process for assessing the potential impacts of AI systems on individuals, groups, and society throughout their entire lifecycle. This process should define how impacts are identified, analyzed, evaluated, and mitigated, and how these assessments are reviewed and updated regularly.

The organization has defined procedures for assessing and treating risks to fundamental rights. The definition includes at least:

• The assessment process
• Methods for fundamental rights analysis
• Criteria for risk evaluation (impact and likelihood)
• Mitigation controls and plans
• Risk acceptance criteria
• Process implementation cycle, resourcing and responsibilities
• The results should be included into the organization risk management process
• The task owner regularly checks that the procedure is clear and produces consistent results

The organization should ensure that its AI system impact assessments are thoroughly grounded in the specific technical, societal, and legal environment in which the AI system operates. This involves analyzing relevant technical constraints, prevailing societal norms and values, and applicable legal and regulatory frameworks to accurately evaluate potential impacts.

The organization should systematically identify and evaluate potential foreseeable abuses of its artificial intelligence systems throughout their lifecycle. This assessment should consider how the system could be intentionally or unintentionally misused, exploited, or lead to unintended harmful outcomes, and integrate these findings into the overall impact assessment.