ISO/IEC 23894 (AI risk management guidance)

What it is

ISO lists ISO/IEC 23894:2023, Information technology — Artificial intelligence — Guidance on risk management as edition 1, published in February 2023, from ISO/IEC JTC 1/SC 42. IEC’s catalog gives the same publication date as 6 February 2023.

The official abstract says the document provides guidance on how organizations that develop, produce, deploy or use products, systems and services that utilize artificial intelligence (AI) can manage risk specifically related to AI. It aims to assist organizations to integrate risk management into their AI-related activities and functions and describes processes for the effective implementation and integration of AI risk management. ISO adds that the application of this guidance can be customized to any organization and its context.

ISO records 26 pages and International Standard published on 2023-02-06. IEC’s catalog matches the February 2023 date as 6 February 2023. The public audience is organizations that develop, produce, deploy or use AI products, systems and services — including engineering teams, not only a corporate risk office.

The life-cycle counterpart on the same committee is ISO/IEC 5338:2023, AI system life cycle processes. 5338’s abstract defines a set of processes and associated concepts for describing the life cycle of AI systems based on machine learning and heuristic systems. That is process description for an AI system. 23894 is organizational risk-management guidance. See ISO/IEC 23894 and 5338 for engineering teams.

What it is not

The catalog page describes guidance, not a management-system certification scheme. For an organizational AI management system that ISO says organizations may choose certification for, see ISO/IEC 42001. This site has not found an official ISO page that says ISO/IEC 23894 is itself certifiable, so we make no such claim.

ISO separately publishes ISO 31000:2018, Risk management — Guidelines, which provides principles and guidelines for risk management and cannot be used for certification purposes. We cite that general standard from ISO’s own page. We have not found an official ISO catalog page that states a clause-by-clause relationship between 23894 and 31000, so this explainer does not invent one.

ISO/IEC 23894 is not an aviation acceptable means of compliance, not a CMMC requirement, and not a functional-safety SIL method. For AI inside safety-related functions, see ISO/IEC TR 5469.

How it relates to other frameworks

• ISO/IEC 42001. 42001 specifies requirements for an Artificial Intelligence Management System. 23894 is the AI-specific risk-management guidance document on ISO’s catalog. They sit next to each other; we do not claim one substitutes for the other. ISO says organizations may choose certification against 42001. We have not found an official ISO page that says 23894 is itself certifiable.
• ISO/IEC 5338. 5338 is the SC 42 AI system life cycle processes International Standard. Use it when the question is process description for an ML or heuristic AI system. Use 23894 when the question is how the organization manages AI-specific risk.
• NIST AI RMF. See the NIST AI RMF explainer. We have not found an official NIST crosswalk from the AI RMF to ISO/IEC 23894 on the pages we cite, so we do not invent one.

Primary sources

Read the catalog entry at iso.org. ISO sells the full text.