ISO 42001 AI system impact assessment template: free Excel with automatic scoring

By the NexoDocs Team · how we make and check our content

An AI system impact assessment is the record of how an AI system could affect people, groups of people and society, positively and negatively, and what you will do about the negative effects. ISO/IEC 42001:2023 asks for it in clause 6.1.4 (define the process) and clause 8.4 (carry it out at planned intervals and when things change), and Annex A controls A.5.2 to A.5.5 describe what it should cover. It is different from the AI risk assessment: the risk assessment looks at risks to your organization and its objectives; the impact assessment looks outward, at the people affected. Below you can download, for free, the complete impact assessment template from our ISO 42001 toolkit, in Excel, with a screening sheet and automatic impact levels.

What ISO 42001 requires for AI impact assessments

Reference	What it asks for (in our words)	Where it goes in the template
Clause 6.1.4	A defined process to assess the potential consequences of AI systems for individuals, groups and society.	Procedure (in the toolkit) + sheet 1 Screening
Clause 8.4	Carry out the assessments at planned intervals and when significant changes occur, and keep documented results.	Sheet 4 Approval (next review date)
A.5.2	Process for the AI system impact assessment.	Sheets 1 to 4, in order
A.5.3	Documentation of the results and retention.	One file per system and version
A.5.4	Impacts on individuals or groups of individuals.	Sheet 3 Impacts, column Affected
A.5.5	Societal impacts.	Sheet 3 Impacts, areas such as public information or environment

ISO/IEC 42005 gives detailed guidance on how to run these assessments. It is optional: what an ISO 42001 auditor checks is that your process exists, is followed and leaves evidence. We cite clauses and controls by number only; the text of the standards is not reproduced.

How to complete the assessment in 4 steps

Screening: answer 8 yes/no questions (decisions about people, personal data, contact with the public, possible harm, high-risk use under the law, automation, bias, effects on society). If any answer is yes, the sheet shows that a full assessment is required.
Description: record the system and version, intended purpose, foreseeable misuse, users, people affected (including vulnerable groups), data used, human oversight, deployment context and your role (provider, developer or user).
Impacts: for each impact, record who is affected, the impact area, whether it is positive or negative, severity (1-4) and likelihood (1-4). The level and category (low, medium, high, critical) are calculated automatically. Then record the measures and the residual severity and likelihood.
Approval: overall conclusion, residual impacts accepted, conditions for deployment, information given to affected people, next review date and who approves. Copy the relevant negative impacts to the AI risk register.

The template, ready to use

ISO 42001 AI impact assessment template in Excel (free)

Screening, description, impacts with automatic scoring and approval. Direct download, no email needed. The full ISO 42001 toolkit adds 66 more files: procedure, AI risk register, AI system inventory, policies, Statement of Applicability and a completed example.

Download the free AI impact assessment template (Excel)

Example: how impact levels are calculated

The template multiplies severity by likelihood (1 to 16) and assigns a category: 1-4 low, 5-8 medium, 9-15 high, 16 critical. A fictitious example for a CV screening tool:

Affected	Impact area	Impact	Severity × likelihood	Level	Measure	Residual
Job applicants	Fairness and non-discrimination	Candidates from some groups are ranked lower because of biased training data	4 × 3 = 12	High	Bias testing before each release; a person reviews every rejection	2 × 2 = 4 (Low)
Job applicants	Privacy and data protection	CV data is kept longer than needed	2 × 3 = 6	Medium	Automatic deletion after the retention period	2 × 1 = 2 (Low)
Recruiters	Employment and working conditions	Less time spent on administrative screening	Positive	—	—	—

We checked these calculations in Excel with the file you download: a «Yes» in the screening sheet switches the result to «full assessment required», and 4 × 3 returns 12 «High» while 2 × 2 returns 4 «Low».

What the free template includes

Screening sheet with 8 questions and an automatic result.
Description sheet with the 10 items an auditor usually asks for.
Impacts sheet with 30 rows, drop-down lists of impact areas, automatic level and category, and residual level after measures.
Approval sheet, plus a configuration sheet with your organization's name, shown in the header of every sheet.
Direct Excel download, no email needed. It is the complete AIMS-AIA-02 file from our ISO/IEC 42001 toolkit, which adds the assessment procedure, the AI risk register, the AI system inventory and a completed example.

Impact assessment, DPIA and fundamental rights assessment

Many organizations must run more than one assessment on the same AI system: the ISO 42001 impact assessment, a data protection impact assessment when GDPR article 35 applies, and, for certain deployers of high-risk systems, the fundamental rights impact assessment of article 27 of the EU AI Act. They overlap a lot. Collect the system description once (sheet 2), reuse it, and keep a cross-reference between the documents. This guide is not legal advice: check which obligations apply to you.

Common mistakes

Assessing only risks to the company and calling it an impact assessment: A.5.4 and A.5.5 are about the people affected and society.
Recording only negative impacts: the template also asks for positive ones, which justify using the system.
Doing it once at launch: clause 8.4 asks for it again at planned intervals and after significant changes (new data, new use, new users).
Not linking it to the risk register: relevant negative impacts should appear as AI risks with an owner and a treatment.
Forgetting vulnerable groups and foreseeable misuse in the description.

Next step

Try it free or go straight to the complete solution.

ISO 27001 ISMS documentation toolkit

84 Word and Excel templates to document your ISMS based on ISO/IEC 27001:2022.

See the full toolkit

Free sample

Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.

Get the free sample

Frequently asked questions

Is the AI impact assessment mandatory in ISO 42001?

Yes. Clauses 6.1.4 and 8.4 require a process and documented results. Annex A controls A.5.2 to A.5.5 can only be excluded in the Statement of Applicability with a justification, which is hard to argue if you use AI systems that affect people.

What is the difference between AI risk assessment and AI impact assessment?

The risk assessment (clause 6.1.2) looks at risks to the organization and its objectives. The impact assessment (clause 6.1.4) looks at the consequences for individuals, groups and society. The results of the second feed the first.

Do I need ISO/IEC 42005?

No. It is a guidance standard that helps you design the process. ISO 42001 certification audits check your own process against ISO 42001.

How often should it be repeated?

At the intervals you define (for example once a year) and whenever the system, its data, its users or its purpose change significantly.

Is this template enough to pass an audit?

No template can promise an audit result. It gives you the structure and evidence an auditor usually asks for; what counts is that you complete it for your real systems and act on it.

Updated: 2026-10-27