ISO/IEC 23894

ISO/IEC 23894 is a guidance standard, so it contains recommendations rather than certifiable requirements. It takes the familiar ISO 31000 structure, with principles, a framework and a process of risk identification, analysis, evaluation and treatment, and explains what changes when the risk source is an AI system. Its annexes describe common AI-related objectives, such as fairness, transparency, robustness, safety and privacy, typical risk sources such as lack of transparency, level of automation, machine learning complexity and data quality, and how risk management maps to each stage of the AI lifecycle.

Its main value is integration. Organizations that already run enterprise risk management under ISO 31000 can extend the same vocabulary, risk appetite and reporting lines to AI rather than build a separate method. It also supports the risk assessment and treatment clauses of ISO/IEC 42001. For example, a risk team can register model drift in a fraud detection system as a risk with likelihood, impact, an owner and a treatment plan, just like any other operational risk.