ISO/IEC 42001 gets the attention because it can be certified. Two companion standards are just as useful day to day.
ISO/IEC 22989: concepts and terminology
Published in 2022, it defines the core vocabulary of AI: AI system, machine learning, training data, the AI lifecycle, and the roles of AI producers, providers, customers and other stakeholders. Its value is consistency. A policy, a contract and a risk assessment that use the same defined terms are easier to read, compare and audit. The EU AI Act uses its own legal definitions, so map the two where they differ.
ISO/IEC 42005: AI system impact assessment
Published in 2025, it gives guidance on assessing how an AI system may affect individuals, groups and society, across its lifecycle. It covers when to assess, what to document, who to involve, and how to record the potential benefits and harms, including foreseeable misuse. It is designed to sit inside a management system run under ISO 42001.
How they fit with legal assessments
An impact assessment under ISO 42005 is not a legal requirement in itself. But it overlaps with assessments the law does require: the data protection impact assessment under the GDPR and UK GDPR, the fundamental rights impact assessment some deployers must carry out under the EU AI Act, and the risk assessments now required under California’s privacy regulations. One well-structured assessment can feed all of them.
The cheapest compliance is the assessment you only have to do once.
What to do
Use 22989’s terms in your AI policy and contracts. Build one impact-assessment template, based on 42005, with sections that answer the specific legal questions in each jurisdiction you operate in.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.