ISO/IEC 23894:2023: guidance on AI risk management
Guidance on AI risk management (companion to ISO 31000)
AIGE-OBL-ISO23894-RISK. Drawn from chapter 08.
Text alternative
- Clause: ISO 23894, ISO/IEC 23894:2023.
- Duty holder: Not stated.
- Applies from: No date, Voluntary.
- Artefact: Risk register as code.
- Layers: Layer 01, Layer 03.
- Evidence record: Risk register entry.
- Record schemas: Risk register entry .
- The same topic in 16 other frameworks; the crosswalk section below links each clause.
- Id
AIGE-OBL-ISO23894-RISK- Instrument
- ISO/IEC 23894:2023 standard
- Clause
- ISO/IEC 23894:2023
- Applies from
- No date Voluntary · Voluntary guidance (2023)
The artefact that evidences it
Risk register as code; AI risk taxonomy; linkage to EU AI Act Art. 9 and the NIST AI RMF.
Data table: every relation
| Family | Item | Relation |
|---|---|---|
| Same crosswalk topic | AI Verify 4.3.1, 4.7.1, 4.2.1 | Core clause |
| Same crosswalk topic | CSA AICM GRC-02, MDS-12 | Core clause |
| Same crosswalk topic | CoE Convention CoE Art. 16 | Core clause |
| Same crosswalk topic | EU AI Act Art. 9, Art. 3 | Core clause |
| Same crosswalk topic | GAO AI Accountability 1.6 | Core clause |
| Same crosswalk topic | ISO 42001 6.1.2, 6.1.3, 8.2, 8.3, A.6, 6.1.4 | Core clause |
| Same crosswalk topic | Korea AI Act Art. 34(1)(1) | Core clause |
| Same crosswalk topic | NIST AI RMF MAP 1, MAP 5, MANAGE 1, GOVERN 1.3, MAP 1.5, MANAGE 1.3, MANAGE 1.4, MEASURE 3, MEASURE 2 | Core clause |
| Same crosswalk topic | Singapore Agentic Agentic 2.1 | Core clause |
| Same crosswalk topic | TC260 Framework 3.0 TC260 2, TC260 Summary table, TC260 5.3.19 | Core clause |
| Same crosswalk topic | UK ATRS ATRS 2.5.2 | Core clause |
| Same crosswalk topic | prEN 18228 prEN 18228 | Core clause |
| Same crosswalk topic | China Algo. Rec. AlgoRec Art. 27 | Related clause |
| Same crosswalk topic | China GenAI Measures GenAI Art. 17 | Related clause |
| Same crosswalk topic | GPAI Code Safety C1, Safety C3 | Related clause |
| Same crosswalk topic | OECD AI Principles OECD 1.5(c) | Related clause |
Patterns that build it
No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.
The same topic in other frameworks
From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.
Risk management
- EU AI Act Art. 9 Risk management system (core)
- ISO 42001 6.1.2 AI risk assessment (core)
- ISO 42001 6.1.3 AI risk treatment (core)
- ISO 42001 8.2 AI risk assessment (operation) (core)
- ISO 42001 8.3 AI risk treatment (operation) (core)
- NIST AI RMF MAP 1 MAP 1: Context is established and understood (core)
- NIST AI RMF MAP 5 MAP 5: Impacts to individuals, groups, communities, organizations, and society are characterized (core)
- NIST AI RMF MANAGE 1 MANAGE 1: AI risks based on assessments and other analytical output are prioritized, responded to, and managed (core)
- TC260 Framework 3.0 TC260 2 Classification of AI safety risks (core)
- TC260 Framework 3.0 TC260 Summary table Risks × technological × governance measures (core)
- NIST AI RMF GOVERN 1.3 GOVERN 1.3: Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance (core)
- NIST AI RMF MAP 1.5 MAP 1.5: Organizational risk tolerances are determined and documented (core)
- NIST AI RMF MANAGE 1.3 MANAGE 1.3: Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented (core)
- NIST AI RMF MANAGE 1.4 MANAGE 1.4: Negative residual risks to both downstream acquirers of AI systems and end users are documented (core)
- NIST AI RMF MEASURE 3 MEASURE 3: Mechanisms for tracking identified AI risks over time are in place (core)
- CSA AICM GRC-02 Risk Management Program (core)
- Korea AI Act Art. 34(1)(1) Risk management plan for high-impact AI (core)
- UK ATRS ATRS 2.5.2 Risks and mitigations (core)
- Singapore Agentic Agentic 2.1 Assess and bound the risks upfront (core)
- CoE Convention CoE Art. 16 Risk and impact management framework (core)
- prEN 18228 prEN 18228 AI risk management (draft; supports Art. 9) (core) (clause not verified)
- GAO AI Accountability 1.6 Risk management: implement an AI-specific risk management plan to systematically identify, analyze, and mitigate risks (core)
- AI Verify 4.3.1 Safety: assess risks, risk metrics and risk levels of the AI system in each specific use case (core)
- AI Verify 4.7.1 Safety: identify and track residual risk that cannot be measured or mitigated, and assess the organisation's tolerance for it (core)
- ISO 42001 A.6 AI system life cycle
- NIST AI RMF MEASURE 2 MEASURE 2: AI systems are evaluated for trustworthy characteristics
- TC260 Framework 3.0 TC260 5.3.19 Re-assessment on material change
- China GenAI Measures GenAI Art. 17 Security assessment and algorithm filing
- China Algo. Rec. AlgoRec Art. 27 Security assessment
- EU AI Act Art. 3 Definitions
- ISO 42001 6.1.4 AI system impact assessment
- GPAI Code Safety C1 Commitment 1: Safety and Security Framework
- GPAI Code Safety C3 Commitment 3: Systemic risk analysis
- CSA AICM MDS-12 Open Model Risk Assessment
- OECD AI Principles OECD 1.5(c) Systematic risk management at each lifecycle phase
- AI Verify 4.2.1 Safety: carry out an assessment of materiality on key stakeholders, highlighting the risks of the proposed AI solution
Source
Chapter 08, section ISO/IEC 42001, 42005 and 42006, checked against its sources on the review date above.
Machine-readable
- This obligation:
/api/v1/obligations/aige-obl-iso23894-risk.json - The register:
/api/v1/obligations.json· CSV - Schema and stability promise: open data and API
Cite this obligation
García Aibar, J. (2026). ISO/IEC 23894:2023: guidance on AI risk management (AIGE-OBL-ISO23894-RISK). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-iso23894-risk. CC BY 4.0
BibTeX
@misc{aige2026obligation,
author = {Jorge García Aibar},
title = {{ISO/IEC 23894:2023: guidance on AI risk management (AIGE-OBL-ISO23894-RISK)}},
howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
year = {2026},
version = {0.5.0},
doi = {10.5281/zenodo.22956197},
url = {https://aigovernanceengineer.com/obligations/aige-obl-iso23894-risk},
note = {Version 0.5.0}
}