Reporting & reassessment

Report structure

Include:

• System, version, purpose and assessment boundary.
• Organisational role and lifecycle stage.
• Method, participants and evidence period.
• Intended use and foreseeable misuse.
• Affected people, groups and society.
• Material benefits and harms.
• Distribution, severity, likelihood, duration and uncertainty.
• Measures, owners and expected effectiveness.
• Residual impacts and accountable decisions.
• Limitations, dissent and unverified assumptions.
• Monitoring and reassessment triggers.

Reporting maturity

Show maturity with coverage and assurance. A single average cannot communicate whether a severe impact remains untreated.

Separate:

• Process maturity.
• Evidence assurance.
• Impact significance.
• Treatment status.
• Residual impact.

Proportionate disclosure

Determine which results should be shared with affected parties, customers, governance bodies or public authorities. Balance transparency with privacy, security, legal privilege and confidential information.

Redaction should protect legitimate interests without concealing material impacts or undermining accountability.

Safe conclusion language

Prefer:

The selected system was assessed against the organisation’s ISO/IEC 42005:2025-aligned method. The assessment identified the stated impacts and treatment measures, with the listed limitations and residual uncertainties. Human approval applies to this system version and use context.

Avoid:

• “ISO 42005 certified.”
• “No impacts.”
• “Fully safe.”
• “Compliant with all impact laws.”

Reassessment triggers

Reassess after:

• Purpose or use change.
• New user or affected population.
• New market, language or deployment environment.
• Model, data, supplier or architecture change.
• Increased autonomy or decision impact.
• Incident, complaint, appeal or unexpected outcome.
• Performance, fairness or drift trend.
• New research or stakeholder evidence.
• Treatment failure or threshold breach.
• Legal or policy change.

Monitoring plan

For each material impact define:

• Indicator and data source.
• Population and disaggregation.
• Threshold.
• Review frequency.
• Owner.
• Escalation and stop criteria.
• Link to reassessment.

Monitoring should be capable of detecting the impact in time to act.