Video narration
Can one assessment satisfy both the EU AI Act and ISO/IEC 42001? Think of a workplace project risk review: identify who could be harmed and how to reduce that harm. But there's no universal checklist. The key distinction: the EU AI Act sets a specific legal trigger. Before use, certain deployers must conduct a fundamental rights impact assessment, or FRIA, for specified high-risk AI systems. This includes some public-service providers and certain credit or insurance uses; the exact duty depends on your role and the system's use. ISO/IEC 42001 takes a different route. It embeds impact assessment in an AI management system, considering consequences for individuals, groups and society. That is a management process, not an EU legal obligation. So, can one replace the other? No. Connect them: use the broader ISO process to manage impacts, and meet the EU Act's FRIA requirement when its legal trigger applies.