Run A One-Page AI Impact Assessment Before Your Public Relations Reporting Workflow Reaches A Client
A simple AI impact assessment can identify governance risks before work reaches a client.
By Gabriel Tan | June 2026
A managing director in Hong Kong signs off a new AI-assisted client reporting workflow on a Tuesday. It works. The team is faster, the output is clean, everyone is pleased. Three weeks later a client asks a simple question. Who checked what this thing might get wrong before you pointed it at our account? The MD has a good answer in their head and nothing on paper. That gap between a good answer and a written one is where this post lives.
There is now a standard for closing it. ISO/IEC 42005, published in 2025, is guidance for assessing how an AI system affects individuals, groups, and society across its lifecycle, used internally with no external auditor required. It turns “we were careful” into a document you can hand across a table.
To be honest, most agencies skip this because it sounds like a regulator's word for paperwork. It is not. It is the difference between defending a decision and improvising one.
A five-box assessment sized for an agency workflow
You do not need the full standard to get the value from it. You need the shape of it, cut down to one page with five boxes.
One, what the system does. A plain sentence. “This PR workflow drafts results announcements from a client's filing and our house template.”
Two, who it affects. Not only the client. The client's audience, the retail investor reading the announcement, any third party named in the coverage. The standard treats these affected people as a defined group whose interests you are expected to have considered.
Three, what could go wrong. A wrong figure carried from source. A tone that misreads a sensitive situation. Confidential information pulled into a prompt and exposed. Name the failures, do not gesture at them.
Four, the control that catches each failure. A senior read before release. A figure check against the source document. A rule that client data never goes into an open tool. One control per risk.
Five, who reviews this and how often. A named owner and a date. An assessment nobody revisits is decoration.
ISO 42005 maps to ISO 42001, the AI management system standard, and sits alongside ISO 23894 for risk management, so the same one page becomes the seed of the execution infrastructure you build later if you want it. You are not doing throwaway work. You are doing the first page of the real thing.
The point is the document, not the perfection
Nobody expects a comms team to assess an AI system the way an aircraft maker assesses a part. The expectation is lower and more useful. You looked, you wrote down what you saw, and you put a control against each risk before the work touched a client.
That written record is what changes the conversation when a client, a board, or your own insurer asks the question. The team with the page answers in thirty seconds. The team running the same client reporting services without it starts a sentence with “well, in practice we usually.”
What to do this week
Pick one workflow and write the page.
Choose a single live AI workflow, the one that touches the most client work. Two minutes.
Fill the five boxes on one page. Forty-five minutes.
Show it to one colleague and one friendly client contact, and watch where they frown. One short call.
The frowns tell you where the real risk sits, which is rarely where you expected.
The workflow with a page behind it is the one you can defend in the room without raising your voice. The one without it is a conversation you will eventually have live, in front of a client, with nothing in your hand. Write the page on a quiet afternoon, not under that kind of light.
Gabriel Tan is the founder of Mekong Bridge Advisory. He builds structured execution systems for PR and communications firms.
