AI Regulation ReferenceDoes ISO/IEC 23894 AI Risk Management require Risk Assessment?
OECD • voluntary
Yes — 1 provision
Requirements at a glance
This regulation imposes 7 specific requirements for Risk Assessment across 1 provision:
- AI risk principles — Apply AI-specific risk management principles adapted from ISO 31000 Clause 4
- Risk identification — Identify AI-specific risk sources including bias, robustness failures, explainability gaps, and misuse
- Risk assessment — Assess likelihood and consequence of identified AI risks throughout the lifecycle
- Risk treatment — Select and implement risk treatment options proportionate to identified risks
- Monitoring and review — Continuously monitor AI risk posture and review risk management effectiveness
- Recording and reporting — Document risk management activities, decisions, and outcomes
- Lifecycle mapping — Apply risk management across the full AI system lifecycle per Annex C
AI-Specific Risk Management Guidance #
ISO/IEC 23894 is the specialist AI risk guidance standard that extends the ISO 31000 risk management framework for AI-specific risks (bias, robustness, explainability failures). Regulators cite it as a reference for "state of the art" risk management when defining what compliant AI risk governance looks like.
Requirements
| Requirement | Details |
|---|---|
| AI risk principles | Apply AI-specific risk management principles adapted from ISO 31000 Clause 4 |
| Risk identification | Identify AI-specific risk sources including bias, robustness failures, explainability gaps, and misuse |
| Risk assessment | Assess likelihood and consequence of identified AI risks throughout the lifecycle |
| Risk treatment | Select and implement risk treatment options proportionate to identified risks |
| Monitoring and review | Continuously monitor AI risk posture and review risk management effectiveness |
| Recording and reporting | Document risk management activities, decisions, and outcomes |
| Lifecycle mapping | Apply risk management across the full AI system lifecycle per Annex C |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Voluntary — no binding enforcement mechanism |