ISO/IEC 42005:2025 and the Article 27 FRIA: what the published impact assessment standard gives a deployer
Category Standards
Published AIAssuranceLabs
ISO/IEC JTC 1/SC 42 has published ISO/IEC 42005:2025Published, AI system impact assessment, a guidance document with a process in clause 5 and a documentation structure in clause 6. The six elements of the fundamental rights impact assessment under Art. 27(1) map onto the clause 6 structure. The standard sets no acceptance value, contains no clause for the notification to the market surveillance authority, and is not cited in the Official Journal. A deployer in scope of Art. 27 uses the standard as the record structure and sets its own impact scale.
What the source says
The catalogue entry recorded as the source in the standards data describes ISO/IEC 42005:2025Published as guidance for organisations performing AI system impact assessments for individuals and societies that can be affected by an AI system: how and when to perform them, how to document them, and how the assessment integrates into AI risk management and an AI management system. The document states no requirement on any organisation. Clause 5 gives the process (5.2 to 5.12) and clause 6 the documentation (6.2 to 6.9). Informative annexes cover use with ISO/IEC 42001:2023Published, published, and with ISO/IEC 23894:2023Published, published, a harms and benefits taxonomy (Annex C) and alignment with other assessments (Annex D).
Art. 27(1) of Regulation (EU) 2024/1689 requires a deployer that is a body governed by public law, a private entity providing public services, or a deployer of a system in Annex III point 5(b) or (c) to perform an assessment with six elements before first use of a high-risk AI system referred to in Art. 6(2). The Art. 27 obligation page restates each element; the table gives the matching clause of the published standard.
| Art. 27 element | Clause of the published standard | Match |
|---|---|---|
| Art. 27(1)(a): deployer's processes, context and conditions of use | 6.3 AI system information; 6.6 deployment environment | Direct |
| Art. 27(1)(b): period and frequency of use | 5.5 and 6.2 scope of the assessment | Partial: no clause names frequency |
| Art. 27(1)(c): categories of persons and groups likely affected | 6.7 relevant interested parties | Direct |
| Art. 27(1)(d): specific risks of harm per category | 6.8 actual and reasonably foreseeable impacts; Annex C taxonomy | Direct; the Art. 13 input comes from the Act |
| Art. 27(1)(e): human oversight measures as implemented | 6.9 measures to address harms and benefits | Partial: no clause names human oversight |
| Art. 27(1)(f): measures if risks materialise, governance, complaints | 6.9 measures; 5.12 monitoring and review | Partial: no clause names a complaint mechanism |
| Art. 27(2): update when an element changes | 5.4 timing; 5.12 monitoring and review | Direct |
| Art. 27(3): notification to the market surveillance authority | 5.10 recording and reporting | None: the clause reports to the organisation |
| Art. 27(4): cross-reference to a data protection impact assessment | 5.3 integration with other management processes; Annex D | Direct |
Three gaps follow. The standard gives no acceptance value: sub-clause 5.7, establishing thresholds for sensitive uses, restricted uses and impact scales, places the scale with the organisation, and Regulation (EU) 2024/1689 gives no value for Art. 27 either. The notification under Art. 27(3), with the template that Art. 27(5) assigns to the AI Office, has no counterpart in clause 5.10. The standard is international, not harmonised: no JTC 21 draft in the standards tracker addresses Art. 27, no harmonised standard is cited in the Official Journal as of the anchor date
Verified on last full verification run, see the change log
, and no presumption of conformity under Art. 40(1) attaches to a FRIA record.The date from which the duty applies is unsettled. The working reading places Art. 27 with the Annex III package under amended Art. 113(c)(i), from the Annex III application date Deferred.
What changes for a provider or deployer
The duty sits with the deployer, who depends on the provider for the documentation clauses. Clauses 6.3 to 6.5 ask for system, data, algorithm and model information that a deployer holds only through the instructions for use under Art. 13(3); Art. 27(1)(d) requires the deployer to take the Art. 13 information into account for each risk of harm. Where the provider supplied no accuracy, limitation or residual-risk statement, the record states the absence, and PR-27-FRIA v1.0 keeps it on an open items list addressed to the provider.
The artifact is the FRIA record: one versioned document whose sections follow the clause structure of the published standard and name the Art. 27(1) point each answers. The protocol records the deployer's likelihood and severity scale with a justification per level at its scale-justification step, rates each register risk on that scale, and marks a check "not verifiable" where evidence is missing. The FRIA outline template orders the six elements by the standard's process so that the content transfers into the AI Office template under Art. 27(5) once the deployer uses it. Regulation (EU) 2026/1744 amended Art. 27(4) and (5) so that the assessment and the template may cross-reference or include parts of a data protection impact assessment under Art. 35 of Regulation (EU) 2016/679, the alignment that Annex D of the standard describes.
The FRIA facilitation service runs the protocol within the limits stated at what we cannot do. The outputs are evidence for the assessment under Art. 27(1) and the notification under Art. 27(3); whether the assessment is complete, the scale adequate and the deployer in scope remain decisions for the deployer and their counsel. The record, section by section, is in the FRIA guide.
What to do now
- Confirm scope under Art. 27(1): the deployer category, the Annex III point the system falls under, and the Annex III point 2 exception.
- Open the record with the six elements in the order of the FRIA outline template and assign one owner role per element (sub-clause 5.6 of the published standard).
- Take the provider's instructions for use under Art. 13(3) as the source for the clause 6.3 to 6.6 content; log what the provider did not supply as open items.
- Set the harm likelihood and severity scale with a justification per level (sub-clause 5.7 places it with the organisation) and record it at the scale-justification step of PR-27-FRIA v1.0.
- Map each Art. 27(1) element met by a data protection impact assessment to the section that meets it under Art. 27(4), instead of attaching it in full.
- Record the review trigger per element under Art. 27(2) and watch the regulation anchor for the date in the working reading.
Related pages
The pages this post rests on.
- Obligations
- Protocols
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.