Digital Lexicon Hub

An international standard providing guidance on managing risks faced by organizations that develop, provide, deploy, or use AI systems.

ISO/IEC 23894 gives organizations a common structure for connecting AI-specific technical and societal concerns with enterprise risk governance and accountable decisions.

A provider uses the standard to identify risks across data, model, integration, user interaction, and post-deployment monitoring, then assigns treatments and residual-risk owners.

The standard does not prescribe universal controls or establish that residual risk is acceptable. It must be adapted to the system, stakeholders, legal context, and organizational risk criteria.

The standard adapts risk-management principles to AI by addressing organizational context, lifecycle activities, stakeholders, sources of risk, assessment, treatment, communication, monitoring, and review. It is guidance rather than a certifiable requirements standard and is intended to integrate with broader risk-management practices.