prEN 18228: AI risk management (draft)
Draft harmonised standard for the risk management system of Art. 9
AIGE-OBL-CEN-PREN18228. Drawn from chapter 08.
Text alternative
- Clause: prEN 18228, prEN 18228.
- Duty holder: Not stated.
- Applies from: No date, Draft or proposed.
- Artefact: Provider risk file….
- Layers: Layer 01, Layer 03, Layer 05.
- Evidence record: Evidence record v1.
- Record schema: Evidence record.
- The same topic in 16 other frameworks; the crosswalk section below links each clause.
- Id
AIGE-OBL-CEN-PREN18228- Instrument
- prEN 18228 AI risk management (draft) standard
- Clause
- prEN 18228
- Applies from
- No date Draft or proposed · Draft; Enquiry vote closed 2026-07-30, as reported
The artefact that evidences it
Provider risk file per system; acceptability criteria as code; control monitoring.
Data table: every relation
| Family | Item | Relation |
|---|---|---|
| Same crosswalk topic | AI Verify 4.3.1, 4.7.1, 4.2.1 | Core clause |
| Same crosswalk topic | CSA AICM GRC-02, MDS-12 | Core clause |
| Same crosswalk topic | CoE Convention CoE Art. 16 | Core clause |
| Same crosswalk topic | EU AI Act Art. 9, Art. 3 | Core clause |
| Same crosswalk topic | GAO AI Accountability 1.6 | Core clause |
| Same crosswalk topic | ISO 23894 23894 6.4, 23894 6.5, 23894 6.6 | Core clause |
| Same crosswalk topic | ISO 42001 6.1.2, 6.1.3, 8.2, 8.3, A.6, 6.1.4 | Core clause |
| Same crosswalk topic | Korea AI Act Art. 34(1)(1) | Core clause |
| Same crosswalk topic | NIST AI RMF MAP 1, MAP 5, MANAGE 1, GOVERN 1.3, MAP 1.5, MANAGE 1.3, MANAGE 1.4, MEASURE 3, MEASURE 2 | Core clause |
| Same crosswalk topic | Singapore Agentic Agentic 2.1 | Core clause |
| Same crosswalk topic | TC260 Framework 3.0 TC260 2, TC260 Summary table, TC260 5.3.19 | Core clause |
| Same crosswalk topic | UK ATRS ATRS 2.5.2 | Core clause |
| Same crosswalk topic | China Algo. Rec. AlgoRec Art. 27 | Related clause |
| Same crosswalk topic | China GenAI Measures GenAI Art. 17 | Related clause |
| Same crosswalk topic | GPAI Code Safety C1, Safety C3 | Related clause |
| Same crosswalk topic | OECD AI Principles OECD 1.5(c) | Related clause |
Patterns that build it
No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.
The same topic in other frameworks
From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.
Risk management
- EU AI Act Art. 9 Risk management system (core)
- ISO 42001 6.1.2 AI risk assessment (core)
- ISO 42001 6.1.3 AI risk treatment (core)
- ISO 42001 8.2 AI risk assessment (operation) (core)
- ISO 42001 8.3 AI risk treatment (operation) (core)
- NIST AI RMF MAP 1 MAP 1: Context is established and understood (core)
- NIST AI RMF MAP 5 MAP 5: Impacts to individuals, groups, communities, organizations, and society are characterized (core)
- NIST AI RMF MANAGE 1 MANAGE 1: AI risks based on assessments and other analytical output are prioritized, responded to, and managed (core)
- TC260 Framework 3.0 TC260 2 Classification of AI safety risks (core)
- TC260 Framework 3.0 TC260 Summary table Risks × technological × governance measures (core)
- ISO 23894 23894 6.4 Risk assessment (core) (clause not verified)
- ISO 23894 23894 6.5 Risk treatment (core) (clause not verified)
- NIST AI RMF GOVERN 1.3 GOVERN 1.3: Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance (core)
- NIST AI RMF MAP 1.5 MAP 1.5: Organizational risk tolerances are determined and documented (core)
- NIST AI RMF MANAGE 1.3 MANAGE 1.3: Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented (core)
- NIST AI RMF MANAGE 1.4 MANAGE 1.4: Negative residual risks to both downstream acquirers of AI systems and end users are documented (core)
- NIST AI RMF MEASURE 3 MEASURE 3: Mechanisms for tracking identified AI risks over time are in place (core)
- CSA AICM GRC-02 Risk Management Program (core)
- Korea AI Act Art. 34(1)(1) Risk management plan for high-impact AI (core)
- UK ATRS ATRS 2.5.2 Risks and mitigations (core)
- Singapore Agentic Agentic 2.1 Assess and bound the risks upfront (core)
- CoE Convention CoE Art. 16 Risk and impact management framework (core)
- GAO AI Accountability 1.6 Risk management: implement an AI-specific risk management plan to systematically identify, analyze, and mitigate risks (core)
- AI Verify 4.3.1 Safety: assess risks, risk metrics and risk levels of the AI system in each specific use case (core)
- AI Verify 4.7.1 Safety: identify and track residual risk that cannot be measured or mitigated, and assess the organisation's tolerance for it (core)
- ISO 42001 A.6 AI system life cycle
- NIST AI RMF MEASURE 2 MEASURE 2: AI systems are evaluated for trustworthy characteristics
- TC260 Framework 3.0 TC260 5.3.19 Re-assessment on material change
- China GenAI Measures GenAI Art. 17 Security assessment and algorithm filing
- China Algo. Rec. AlgoRec Art. 27 Security assessment
- EU AI Act Art. 3 Definitions
- ISO 42001 6.1.4 AI system impact assessment
- ISO 23894 23894 6.6 Monitoring and review (clause not verified)
- GPAI Code Safety C1 Commitment 1: Safety and Security Framework
- GPAI Code Safety C3 Commitment 3: Systemic risk analysis
- CSA AICM MDS-12 Open Model Risk Assessment
- OECD AI Principles OECD 1.5(c) Systematic risk management at each lifecycle phase
- AI Verify 4.2.1 Safety: carry out an assessment of materiality on key stakeholders, highlighting the risks of the proposed AI solution
Source
Chapter 08, section What is NOT harmonised yet, checked against its sources on the review date above.
Machine-readable
- This obligation:
/api/v1/obligations/aige-obl-cen-pren18228.json - The register:
/api/v1/obligations.json· CSV - Schema and stability promise: open data and API
Cite this obligation
García Aibar, J. (2026). prEN 18228: AI risk management (draft) (AIGE-OBL-CEN-PREN18228). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-cen-pren18228. CC BY 4.0
BibTeX
@misc{aige2026obligation,
author = {Jorge García Aibar},
title = {{prEN 18228: AI risk management (draft) (AIGE-OBL-CEN-PREN18228)}},
howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
year = {2026},
version = {0.5.0},
doi = {10.5281/zenodo.22956197},
url = {https://aigovernanceengineer.com/obligations/aige-obl-cen-pren18228},
note = {Version 0.5.0}
}