# AI Management System – Policy & Impact Assessment

> ISO/IEC 42001:2023 (AIMS) – the AI management standard. Two
> artifacts here: the AI policy + the AI system impact assessment
> (the AIMS analog of a DPIA, per Annex A controls).

| Field | Value |
|-------|-------|
| Document ID | DOC-AIMS-NNN |
| AI system | name/version |
| Owner | AI governance lead |
| Date | YYYY-MM-DD |

## Part A – AI policy commitments

1. AI systems are developed/used responsibly: fairness, transparency,
   accountability, safety, privacy.
2. AI risk is assessed before deployment and monitored continuously.
3. Human oversight level is defined per system and enforced.
4. Roles and responsibilities for AI governance are assigned.
5. Legal obligations (AI Act, sector rules) are tracked and met.

## Part B – AI system impact assessment

### B.1 System description

- Purpose, users, affected stakeholders
- Model type, data sources, decision autonomy level
- Deployment context (internal / customer-facing / regulated domain)

### B.2 Risk classification

| Dimension | Assessment | Rating |
|-----------|------------|--------|
| Impact on individuals' rights | decisions about people? | H/M/L |
| Safety impact | physical harm possible? | |
| Scale | number of people affected | |
| Autonomy | human-in/on/out-of-loop | |
| Data sensitivity | personal/special category data | |

### B.3 Impact analysis

| Impact area | Description | Likelihood | Severity | Mitigation |
|-------------|-------------|------------|----------|------------|
| Fairness/bias | group disadvantage | | | bias testing |
| Transparency | explainability to subjects | | | model cards |
| Privacy | data exposure | | | DPIA link |
| Safety | harmful outputs | | | guardrails, HITL |
| Security | adversarial attack | | | red teaming |

### B.4 Controls & monitoring

| Control | Implementation | Monitoring metric | Review |
|---------|----------------|-------------------|--------|
| Human oversight | review step in workflow | override rate | monthly |
| Performance drift | eval harness | accuracy delta | continuous |
| Bias monitoring | subgroup metrics | fairness delta | quarterly |

### B.5 Decision

- [ ] Deploy as assessed
- [ ] Deploy with conditions
- [ ] Not acceptable – redesign

Approved: ____________ Date: ________