ISO/IEC 23894:2023

Overview

ISO/IEC 23894:2023 - "Information technology - Artificial intelligence - Guidance on risk management" provides targeted guidance for organizations that develop, produce, deploy or use AI products, systems and services. Mirroring the structure of ISO 31000:2018, this standard helps integrate AI-specific risk management into existing organizational governance, processes and the AI system life cycle. It is customizable to any organization and covers principles, a risk management framework and detailed processes for assessment, treatment, monitoring and improvement.

Keywords: ISO/IEC 23894:2023, AI risk management, ISO 31000, AI governance, risk assessment, AI lifecycle

Key topics and technical guidance

The standard focuses on practical, AI-specific guidance rather than prescriptive technical specifications. Main topics include:

• Principles of AI risk management
  • Integrating risk management into all organizational activities
  • Inclusiveness, customization and a structured approach tailored to AI
• Risk management framework (leadership to improvement)
  • Leadership and commitment, assigning roles and accountability
  • Integration with organizational objectives, design, implementation, evaluation and continual improvement
• Risk management process
  • Communication and consultation with stakeholders
  • Defining scope, context and risk criteria for AI use cases
  • Risk assessment steps: identification, analysis and evaluation
  • Risk treatment: selecting and implementing mitigation options
  • Monitoring, review, recording and reporting of AI risks
• Annexes and practical aids
  • Annex A: common AI-related objectives
  • Annex B: AI risk sources (e.g., data, model, system and operational aspects)
  • Annex C: mapping risk management activities to an AI system life cycle

Note: ISO/IEC 23894:2023 provides guidance that complements ISO 31000:2018 and other AI standards; it does not replace organizational policies or industry-specific regulatory requirements.

Practical applications and who should use it

ISO/IEC 23894:2023 is relevant to a wide range of stakeholders involved in AI risk and governance:

• AI developers, ML engineers and system architects - to embed risk controls into design and development
• Product managers and program leads - to align AI features with organizational risk appetite
• Risk managers, compliance and internal audit teams - to assess AI-specific threats and track mitigation
• Procurement and vendor management - to evaluate third-party AI suppliers against risk criteria
• Regulators and policy teams - to understand structured, standards-based approaches to AI risk
• Cross-functional teams (legal, privacy, security, ethics) - for stakeholder consultation and lifecycle oversight

Related standards

• ISO 31000:2018 - Risk management - Guidelines (framework alignment)
• ISO/IEC 22989:2022 - AI concepts and terminology
• ISO Guide 73:2009 - Risk management vocabulary

ISO/IEC 23894:2023 helps organizations operationalize AI risk management: aligning governance, technical controls, stakeholder engagement and continuous monitoring across the AI lifecycle.