Standards and frameworks · Artificial intelligence

ISO/IEC 23894:2023 Information technology – Artificial intelligence – Guidance on risk management

PublishedPaid · 6 February 2023

Standards are protected by copyright and almost always sold: here you find metadata, an original summary and a link to the official catalogue page where they can be consulted or bought. The text is not reproduced.

Summary

The standard explains how organisations that develop, produce, deploy or use artificial intelligence systems can manage the risks specific to them. It takes the principles and process of ISO 31000 (risk identification, analysis, evaluation and treatment, monitoring and communication) and adapts them to AI, with attention to issues such as data quality and bias, transparency and explainability, robustness, security, system autonomy and effects on people and society. An annex maps risk management activities to the stages of the system lifecycle. It is used together with ISO/IEC 42001 and to set up the risk management system that the AI Act requires of providers of high-risk systems.

Reference

ISO/IEC 23894:2023

Official title

Information technology – Artificial intelligence – Guidance on risk management

Body

ISO / IEC – Technical committee: ISO/IEC JTC 1/SC 42

Type

Standard

Status

Published

Published

6 February 2023

Edition

1.0

Access to the text

Paid

Sectors

• Artificial intelligence
• Governance and coordination

Equivalent adoptions

• EN ISO/IEC 23894:2024

Notes

It has been adopted unchanged as the European standard EN ISO/IEC 23894:2024. It is not a harmonised standard under the AI Act. The standard is published jointly by ISO and IEC; the link leads to the IEC catalogue.

Last verified

2 November 2026 (verified via web)

Metadata and summary: CC BY 4.0 · JSON

Report an error in this record (opens in a new tab)