One-line summary
ISO/IEC 23894:2023 (Information technology — Artificial intelligence — Guidance on risk management), published on February 6, 2023 by ISO/IEC JTC 1/SC 42, guides organizations that develop, produce, deploy or use AI to manage AI-related risks, and is designed to be used together with ISO 31000:2018.
Standard Overview
| Item | Detail |
|---|---|
| Standard number | ISO/IEC 23894:2023 |
| Title | Information technology — Artificial intelligence — Guidance on risk management |
| Publisher | ISO and IEC, prepared by Joint Technical Committee ISO/IEC JTC 1, Subcommittee SC 42 (Artificial intelligence) |
| Status | International Standard, current (First edition) |
| Publication date | February 6, 2023 |
| Edition / pages | Edition 1.0, 26 pages |
Scope
This document provides guidance on how organizations that develop, produce, deploy or use products, systems and services utilizing artificial intelligence (AI) can manage risk specifically related to AI, and helps integrate risk management into their AI-related activities and functions. The Introduction states it is intended to be used in connection with ISO 31000:2018 (Risk management — Guidelines); its clause structure mirrors ISO 31000:2018 with AI-specific sub-clauses added. Normative references include ISO 31000:2018, ISO Guide 73:2009 (Risk management — Vocabulary) and ISO/IEC 22989:2022 (AI concepts and terminology). Application can be customized to any organization and its context.
Key Clause Points
| Clause | Content | Affected parties |
|---|---|---|
| Clause 4 Principles | Sets out AI risk management principles, extending ISO 31000:2018 Clause 4 with AI-specific considerations | All organizations performing AI risk management |
| Clause 5 Framework | 5.2 Leadership and commitment, 5.3 Design, 5.4 Integration (understanding the organization and its context, articulating commitment, assigning roles and accountabilities, allocating resources, establishing communication and consultation), 5.6 Implementation, 5.7 Evaluation and continual improvement | Management and AI governance functions |
| 6.3 Scope, context and criteria | Defining scope, external and internal context, and risk criteria | Risk management departments |
| 6.4 Risk assessment | 6.4.2 Risk identification, 6.4.3 Risk analysis, 6.4.4 Risk evaluation | Teams developing, deploying and using AI |
| 6.5 Risk treatment | Selecting treatment options, preparing and implementing treatment plans | Risk owners and business units |
| 6.6/6.7 Monitoring, review, recording and reporting | Continual monitoring and review; recording and reporting risks | Compliance, audit and operations |
| Annexes A/B/C (informative) | A: AI-related objectives; B: AI-related risk sources; C: example mapping between risk management process and AI system life cycle | Risk analysts |
Compliance Recommendations
- Integrate AI risk management into your existing ISO 31000:2018-based risk management system, build the framework per Clause 5 and secure leadership commitment.
- Perform risk identification, analysis and evaluation across the AI system life cycle per Clause 6.4, using the Annex C mapping as a reference.
- Select treatment options (avoid, reduce, transfer, accept, etc.) per Clause 6.5 and document a written treatment plan.
- Maintain continual monitoring and review (Clause 6.6) and record/report risk information per Clause 6.7 for traceability.
- Align terminology with ISO/IEC 22989:2022 and ISO Guide 73:2009 to keep consistent definitions inside and outside the organization.