ISO/IEC 23894
In plain wordsAn international guidance standard that explains how organizations can apply ordinary risk-management practice to the particular risks of AI systems.
The international standard 'Information technology — Artificial intelligence — Guidance on risk management', which adapts the general risk-management principles, framework and process of ISO 31000 to organizations that develop, deploy or use AI. It describes AI-specific risk sources — such as lack of transparency, level of automation, machine-learning data quality, system complexity, life-cycle issues and hardware limits — and maps risk-management activities to the stages of the AI life cycle. As guidance rather than requirements, it cannot be certified against; organizations typically use it to build the risk assessment demanded by ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality. or the NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use..
Our risk register follows the process in ISO/IEC 23894, tailored to each model's life-cycle stage.
Origin
Developed by ISO/IEC JTC 1/SC 42ISO/IEC JTC 1/SC 42, prop. n.: The international committee that writes the main worldwide technical standards on artificial intelligence, run jointly by the standards bodies ISO and IEC. and published in February 2023, building on ISO 31000:2018 and the vocabulary of ISO/IEC 22989ISO/IEC 22989, prop. n.: An international standard that fixes agreed meanings for basic AI words — such as AI system, machine learning and trustworthiness — so that other standards, contracts and laws can use the same vocabulary..
Usage note
Guidance ('should') rather than requirements ('shall'). Not to be confused with ISO/IEC 42001, the certifiable management-system standard, or with the European EN 18228 on AI risk management being prepared for the EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models..
Related
- ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality.
- ISO/IEC JTC 1/SC 42ISO/IEC JTC 1/SC 42, prop. n.: The international committee that writes the main worldwide technical standards on artificial intelligence, run jointly by the standards bodies ISO and IEC.
- NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use.
- risk-based approachrisk-based approach, n.: A way of regulating AI in which the strictness of the rules depends on how much harm a use could cause: bans for the worst uses, heavy checks for risky ones, little or nothing for the rest.
- harmonised standardsharmonised standards, n.: Official European technical standards, written at the EU's request, that companies can follow to show their AI systems meet the law, instead of proving it from scratch.
Sources
- ISO/IEC 23894:2023. Information technology — Artificial intelligence — Guidance on risk management. Geneva: ISO.
Mentioned in
ISO/IEC JTC 1/SC 42ISO/IEC JTC 1/SC 42, prop. n.: The international committee that writes the main worldwide technical standards on artificial intelligence, run jointly by the standards bodies ISO and IEC.