ISO 42001 is the management system standard for governing AI across an organisation. It sets requirements for policies, risk management, controls, accountability, and continual improvement. ISO 42005 is a guidance standard focused on AI impact assessment. It helps identify, evaluate, and document potential effects of an AI system on people, organisations, and society. In practice, 42001 defines the governance framework, while 42005 supports the assessment process within it.
How ISO 42001 and ISO 42005 differ in AI governance
ISO 42001 and ISO 42005 sit at different layers of the same ai governance programme. ISO 42001 is the management system standard: it defines how an organisation should govern AI through policy, roles, accountability, controls, monitoring, and continual improvement. ISO 42005 is a guidance standard for AI impact assessment: it helps teams identify and document effects before, during, or after an AI system is deployed.
The practical difference is that ISO 42001 is the operating model, while ISO 42005 is one of the methods you can use inside that model. A mature programme usually needs both: 42001 to establish governance discipline and 42005 to make risk and impact assessment repeatable, auditable, and tied to real use cases. The two are complementary, but they do not do the same job.
Think of 42001 as answering, “How do we run AI responsibly at organisational scale?” and 42005 as answering, “How do we assess the consequences of a specific AI system or use case?” That distinction matters because governance failures usually happen when organisations have policy language but no consistent assessment process, or when they assess impacts ad hoc without a management system that turns the findings into decisions and oversight.
What each standard asks you to do
ISO 42001 is about establishing and maintaining an AI management system. It pushes organisations to define scope, assign responsibility, set objectives, manage risk, operate controls, and review performance over time. The standard is useful when you need a durable governance structure that can survive staff changes, vendor changes, new model deployments, and audit scrutiny.
ISO 42005 is about impact assessment. It is the standard you reach for when you need to evaluate how an AI system may affect individuals, groups, organisations, or society. The assessment may cover bias, rights, safety, business harm, transparency, or other downstream effects, depending on the use case. It is more analytical than managerial, and more focused on evidence gathering than on governance architecture.
That means 42001 is broader in scope, while 42005 is narrower but deeper on assessment workflow. In practice, 42001 tells you who owns the AI governance programme and how decisions are controlled, while 42005 helps you produce the assessment artefacts that inform those decisions.
Where the standards meet in a real programme
In a functioning AI governance setup, 42001 is the umbrella and 42005 is a supporting process. A governance board or control owner can require impact assessments for use cases above a defined risk threshold, then use the results to decide whether to approve, restrict, monitor, or redesign the system. For a broader orientation to this operating model, AI Governance Guide is the clearest internal starting point.
That relationship is also why organisations often crosswalk 42001 to related governance and risk programmes rather than treating it as a standalone document. The management system sets the rules, and the impact assessment produces the evidence those rules need. Where teams already use a formal AI risk process, 42005 usually supplies the assessment structure, while 42001 supplies the governance framework that makes the process accountable and repeatable. The ISO/IEC 42001 Guide is useful here because it covers both the management system clauses and the impact-assessment relationship.
For practitioners comparing standards and implementation choices, the main question is not which one is “better.” It is whether you need a governance system, an assessment method, or both. Most enterprises need both, and the deployment path is usually to build the 42001 governance layer first, then operationalise 42005 as one of the required assessment artefacts for higher-risk systems.
Risk and Threat Considerations
The main risk is confusing governance with assessment. If you adopt ISO 42001 without a disciplined impact-assessment workflow, you can end up with policies that do not reveal where the real harm is likely to occur. If you adopt ISO 42005 without an organisational management system, you can produce good assessments that never change approvals, monitoring, or accountability. Either gap weakens defensibility, especially when AI use cases affect people, regulated decisions, or material business processes.
Failure mechanism: Teams treat 42001 as a documentation exercise or treat 42005 as a one-time checklist, so findings are not translated into ownership, controls, or decision rights. That creates blind spots where high-impact use cases proceed without consistent review, escalation, or follow-up.
Impact: The organisation may miss harmful effects, misstate its AI governance maturity, or lack evidence that it assessed and managed consequential AI systems before deployment. That becomes especially problematic when challenged by auditors, regulators, customers, or internal assurance teams.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST AI RMF sets the technical controls, while ISO/IEC 42001:2023 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 42001:2023 | 4.1 — Understanding the organization and its context | AI governance needs organisational scope and context setting. |
| 5.2 — AI policy | The question contrasts the governance framework with assessment guidance. | |
| 6.1 — Actions to address risks and opportunities | 42001 requires risk treatment, which impact assessments inform. | |
| Recommendation — Define AI governance scope and context before approving use cases. Publish an AI policy that sets governance expectations and decision rights. Use risk treatment decisions to turn impact findings into controls. | ||
| NIST AI RMF | GOVERN — Govern | The contrast maps to governance structure versus assessment practice. |
| Recommendation — Establish governance roles and processes before scaling AI assessment. | ||
Practitioner Guidance
What to prioritise: Use ISO 42001 to establish the governance structure first, then embed ISO 42005 as the assessment method for AI use cases that can create meaningful impact. If the organisation cannot show who approves, reviews, and revises AI decisions, the assessment process alone will not be enough.
What to verify: Check that impact assessments feed directly into approval, controls, monitoring, and periodic review, rather than living as separate paperwork. The test is whether a completed assessment changes an actual decision or control posture.
Practitioner takeaway: ISO 42001 gives you governable AI; ISO 42005 gives you assessable AI. Mature programmes use 42001 to own the system and 42005 to prove they understand the consequences of each significant AI use case.
Related resources from NHI Mgmt Group
- What is the difference between ISO 27001 and ISO 42001 for AI governance?
- What is the difference between attack surface management and NHI governance?
- What is the difference between role-based access and API key governance for NHI security?
- What is the difference between human IAM controls and NHI governance?