Direct answer: accuracy only describes average performance on a set of data; it does not say who is harmed when the model is wrong, or how badly. Errors in recruitment AI fall on applicants and may concentrate in certain age or language groups; a hospital's administrative summaries and imaging support may share data and staff but have entirely different intended purposes and patient impact; in a factory, a missed defect is a quality loss while a missed danger-zone alert can injure someone. ISO/IEC 42001 requires AI system impact assessment by context of use, with oversight, failure handling and acceptance criteria set for each, rather than one certificate or one average.
Assess each context separately
| Context | Who bears the error | What else to examine | Acceptance cannot rest on |
|---|---|---|---|
| CV ranking | Applicants | Differences in pass rates between groups, data limits, complaints and human review | Overall accuracy |
| Medical admin summaries / imaging support | Patients, clinicians | Intended purpose, user qualifications, regulatory boundaries, division of responsibility | A single risk level |
| Factory defect detection / danger-zone alerts | Product quality / people on site | Consequences of misses, fail-safe behaviour, human oversight, conditions for switching off | The same model's average performance |
What a consultant should deliver
- One AI system impact assessment per use: affected people, possible harms, severity, reversibility, mitigations
- Acceptance criteria by use: performance by group, cost of misses and false alarms, go-live thresholds
- Human oversight design: who can intervene at which point, how to switch off, how to keep records
- Complaint and review mechanisms for uses that make decisions about people
- A list of items to confirm on legal duties in the countries of actual use, with opinions from lawyers
How to accept the work
When one model serves two uses, there are two impact assessments, two sets of acceptance criteria and two go-live approvals; performance by group is backed by test evidence, not a single average.
What cannot be guaranteed
Impact assessment makes risks visible and gives them owners, but it does not guarantee zero bias or zero incidents; whether something is discrimination or a medical device is for lawyers or regulators to decide.
Winners Consulting's approach
The following describes Winners Consulting's own approach. Please test us with the same questions above, and test other consultants too.
- Who leads: VP- and director-level consultants guide the whole engagement, without outsourcing
- Project rhythm (as listed on our service page): scope and inventory 2–4 weeks, risk and impact assessment 3–5 weeks, system build 6–10 weeks, audit and certification 4–8 weeks; organisations that already hold ISO 27001 usually reach certification in 4–6 months, from scratch about 6–9 months
- Division of roles: we build the system and the evidence chain; legal opinions come from partner lawyers; certification is carried out by a certification body accredited under ISO/IEC 42006, which we accompany but do not stand in for
- Completed work (anonymous, under a non-disclosure agreement): an industrial automation manufacturer built an AI system inventory, completed AI risk classification, established algorithm review and human oversight for high-risk uses, and obtained ISO 42001 certification
Related questions
- How does an AI system impact assessment differ from a DPIA? A DPIA looks at risks to data subjects from processing personal data; an AI system impact assessment looks at the AI's effects on individuals, groups and society, including bias, fairness, safety and employment. They can share facts, but their content and approval steps must each be completed. ISO 42001 implementation
- Is recruitment AI high-risk if used in the EU? Annex III of the EU AI Act lists employment and workers' management uses; whether a system is high-risk and which date applies depends on its actual use and the amended rules. How to choose an EU AI Act consultant in Taiwan
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.