GLOSSARY

An international standard providing guidance on managing risks faced by organisations that develop, provide, deploy, or use AI systems.

ISO/IEC 23894 gives organisations a common structure for connecting AI-specific technical and societal concerns with enterprise risk governance and accountable decisions.

A provider uses the standard to identify risks across data, model, integration, user interaction, and post-deployment monitoring, then assigns treatments and residual-risk owners.

The standard does not prescribe universal controls or establish that residual risk is acceptable. It must be adapted to the system, stakeholders, legal context, and organisational risk criteria.

The standard adapts risk-management principles to AI by addressing organisational context, lifecycle activities, stakeholders, sources of risk, assessment, treatment, communication, monitoring, and review. It is guidance rather than a certifiable requirements standard and is intended to integrate with broader risk-management practices.