Use-case-based guidance for identifying AI risks across data, models, people and operations, then planning controls and reassessment.
Scope and use
ISO/IEC 23894:2023 provides guidance for managing risks related to AI. It is guidance, not an AI management-system certification requirement and not a substitute for a context-specific risk assessment.
Key requirements
- Describe the intended use, affected people, data sources, model limits, human decisions and expected outcomes.
- Assess likelihood and impact across the AI lifecycle, including development, deployment, monitoring, change and retirement.
Implementation outline
- Describe the intended use, affected people, data sources, model limits, human decisions and expected outcomes.
- Assess likelihood and impact across the AI lifecycle, including development, deployment, monitoring, change and retirement.
- Select treatment options, owners, controls and evidence. Reassess when data, model, purpose, users or operating context changes.
- Map the AI lifecycle; set risk criteria; identify and analyze risks; decide treatment; record residual risks and approvals; monitor indicators and review incidents.