An AI system impact assessment looks outward. Where an AI risk assessment asks what could go wrong for the organization and its objectives, the impact assessment asks what the AI system could do to the individuals, groups and societies it affects, whether through its intended use or foreseeable misuse.
Why ISO/IEC 42001 asks for both
The two assessments catch different things. A system can pose little risk to the business and still have a significant effect on the people it makes decisions about, such as job applicants or customers. ISO/IEC 42001 requires an organization to assess both, and to use the results when deciding which controls apply.
Guidance
ISO/IEC 42005:2025 gives guidance on carrying out AI system impact assessments. It is not certifiable on its own, but it is the most direct reference for building a repeatable method.
Doing it well
The assessment should happen before an AI system goes live and again when it changes significantly. A short, consistent method that teams actually use is worth more than a long template completed once. See ISO 42001 consulting.