ISO/IEC 42005

Gamut supports AI system impact assessment aligned to ISO/IEC 42005:2025. The module provides 119 atomic assessment items covering the assessment process, its documentation and the analysis and treatment of actual and reasonably foreseeable impacts.

The central question is:

For this selected AI system, its intended and foreseeable uses, affected parties and operating context, what benefits and harms may arise, how were they evaluated, and what measures and accountable decisions follow?

Start here

If you need to…	Read
Understand system scope, the process and 119-item catalogue	Scope, process and catalogue
Complete an assessment end to end	Assessment workflow
Explain maturity, assurance and approved N/A	Maturity, assurance and applicability
Gather evidence and engage affected parties	Evidence, engagement and findings
Use per-item and whole-system AI assistance	AI Assist and security
Report and maintain the impact assessment	Reporting and reassessment
Look up labels and safe explanatory language	Reference and glossary

At a glance

Property	Gamut assessment
Standard	ISO/IEC 42005:2025, edition 1
Nature	Guidance for AI system impact assessment
Scope	One selected AI system, version and use context
Structure	Clauses 5 and 6 represented in five sections
Atomic items	119
Maturity	1 Not Addressed to 5 Optimised
Assurance depth	Unverified, Documented, Implemented, Assured
Applicability	In-scope by default; N/A requires structured human approval
Evidence boundary	Selected system, affected parties, context and assessment period
AI support	Per-item and complete-system advisory analysis
Accountability	Human assessor owns scope, engagement, impact, treatment and conclusion

The five sections

Section	Items	Purpose
Process Foundation	18	Establish and document a repeatable, integrated impact-assessment process
Governance & Triggers	25	Timing, scope, responsibilities and thresholds for sensitive or restricted uses
Execution & Review	25	Perform, analyse, record, approve, monitor and review assessments
Documentation Content	29	System, use, data, model, deployment and interested-party information
Impacts & Measures	22	Identify impacts and record measures addressing harms and benefits

How Gamut operationalises the assessment

Selected AI system and approved boundary
  → intended use, foreseeable misuse and affected parties
  → impact-assessment trigger, responsibility and thresholds
  → 119 atomic maturity and assurance decisions
  → evidence, stakeholder input, tests and findings
  → harms, benefits, measures and residual uncertainty
  → accountable system-level conclusion
  → monitoring and event-driven reassessment

What a defensible record contains

Selected system, version, purpose and deployment environment.
Organisational role, lifecycle stage and dependencies.
Intended uses and reasonably foreseeable misuse.
Directly and indirectly affected people, groups and society.
Data, model, algorithm and deployment information.
Stakeholder and affected-party engagement.
Actual and foreseeable beneficial and adverse impacts.
Severity, likelihood, distribution, reversibility and uncertainty.
Measures, owners, residual impacts and decision thresholds.
Objective evidence, testing, findings and limitations.
Approval, publication decision, monitoring and reassessment triggers.

What the assessment does not prove

It does not by itself prove:

That every affected party was identified.
That stakeholder engagement occurred because a policy requires it.
That legal impact assessments are complete.
That a high maturity score means impacts are acceptable.
That an item is irrelevant without an approved basis.
That crosswalked evidence automatically satisfies the guidance.
That AI-generated analysis is an approved impact conclusion.