ISO 23894 AI risk management and requirements, turned into a risk process your AI teams actually follow.

What it is

What is ISO 23894 AI risk management and what is it used for?

ISO/IEC 23894 gives organisations a structured way to manage risk that arises specifically from artificial intelligence. It was prepared by ISO/IEC JTC 1/SC 42, the joint committee responsible for AI standards, and it applies whether you build models, embed AI in a product, or rely on AI services bought from a supplier. Its stated aim is to help you integrate risk management into AI-related activities and functions, rather than treating AI as a separate compliance exercise.

The document is written to sit on top of ISO 31000:2018. It mirrors the ISO 31000 clause structure and, where AI changes the picture, refers to the relevant ISO 31000 clause and adds AI-specific guidance. For a business that already manages enterprise risk to ISO 31000, that design is the practical advantage: AI risk becomes an extension of an existing method, with its own objectives, risk sources and life-cycle touchpoints, not a parallel register nobody reconciles.

Current edition. ISO/IEC 23894:2023, the first edition, published in February 2023, 26 pages. ISO lists it as under systematic review; no new edition has been announced. In Europe it has been adopted as EN ISO/IEC 23894:2024. It is guidance, so there is no transition timetable and no certificate to maintain. ISO/IEC 42001, the certifiable AI management system standard

Who it is for

Who needs ISO 23894?

No law or scheme makes ISO/IEC 23894 compulsory. Organisations adopt it because they need a defensible, repeatable way to decide which AI risks are acceptable, and to show others how those decisions were made. The four situations we see most often:

• A customer asks how you control your AI. Enterprise buyers now send AI questionnaires with their due diligence. A documented risk process aligned to the international guidance gives your answers substance, and the records to back them.
• A tender or partner expects recognised practice. Public and private procurement increasingly asks suppliers to explain AI risk controls. Alignment with ISO/IEC 23894, or certification to ISO/IEC 42001 using it as the method, answers that in terms evaluators understand.
• A regulator or board wants AI risk on the record. Where AI rules or sector supervisors expect risk management for AI systems, an established method helps; we work alongside your legal advisers on what the applicable law itself requires.
• A group company needs one approach across entities. Subsidiaries adopting AI at different speeds benefit from shared risk criteria, one register format and a common way of escalating decisions to group risk.

What you gain is clarity about AI risk and evidence that it is managed. That depends on the method being used by the teams who design and run the systems, not on a policy document.

Requirements

What are the ISO 23894 requirements?

Strictly, ISO/IEC 23894 contains recommendations rather than certifiable requirements, because it is guidance. Its content follows the ISO 31000 pattern of principles, framework and process, with three informative annexes. At title level:

• Principles of AI risk management: the ISO 31000 principles, with the considerations AI adds to some of them.
• Framework: leadership and commitment, integration, design (context, commitment, roles, resources, communication), implementation, evaluation and improvement of AI risk management.
• Communication and consultation: involving the right internal and external stakeholders throughout the process.
• Scope, context and criteria: defining the scope, understanding the external and internal context and setting risk criteria.
• Risk assessment: identification of assets, risk sources, events, controls and consequences, followed by analysis of consequences and likelihood, and evaluation.
• Risk treatment: selecting treatment options, then preparing and implementing treatment plans.
• Monitoring, review, recording and reporting: keeping the assessment current and the decisions traceable.
• Annexes A, B and C: common AI-related objectives, AI risk sources, and an example mapping of the process to the AI system life cycle.

Implementation route

How do you implement ISO 23894?

Because there is no certificate, the route is implementation and demonstrable use. Sterling builds the method with you and runs it until your teams operate it on their own; if you also want independent assurance, the route continues into ISO/IEC 42001 certification with an accredited certification body.

1. 01
   Map your AI and agree the scope.List the AI systems you develop, deploy or use, who owns each one and which decisions or customers it affects.
2. 02
   Gap analysis against the guidance.Compare current risk practice with the principles, framework and process of ISO/IEC 23894 and agree actions, owners and dates.
3. 03
   Set the framework and criteria.Define roles, risk criteria and escalation, and connect them to your enterprise risk method and life-cycle checkpoints.
4. 04
   Run the first assessment and treatment cycle.Workshops with system owners identify, analyse and evaluate risks; treatment plans are approved and tracked to completion.
5. 05
   Monitor, review and, if wanted, certify.Reassess on change and on schedule, report to management, and where assurance is needed prepare the ISO/IEC 42001 system for its certification audit.

Check the route before you sign. Anyone offering an "ISO 23894 certificate" is offering something no accredited scheme provides. If independent assurance matters, ask which certification body would audit ISO/IEC 42001, confirm its accreditation for that standard with the accreditation body, and check the recognition under the Global ACI arrangement. How to verify an ISO/IEC 42001 certificate

Cost

How much does ISO 23894 implementation cost?

The effort follows your AI footprint, not a price list. A firm using two supplier AI tools needs a lighter framework than a developer releasing its own models to customers. Your proposal shows each component and one all-inclusive proposal.

Timeline

How long does ISO 23894 implementation take?

A first complete cycle, from scoping to approved treatment plans, typically takes two to four months, as an estimate that depends on how many systems are in scope and how quickly owners are available. The method is only proven once it has been repeated on a change, so we plan the first reassessment into the timeline.

If a customer questionnaire or board meeting sets the date, tell us at the outset and we will plan backwards from it, with a clear view of what can be evidenced by then.

Your engagement

What your ISO 23894 engagement includes

Your engagement follows Sterling OS™. Design™ and Drive™ are alternative levels of support, and you choose one of them; Sustain™ and Automate™ keep the method running afterwards. Sterling does not certify: ISO/IEC 23894 has no certificate, and where you pursue ISO/IEC 42001 an accredited certification body audits and decides.

• Design™: guided support

  We provide the framework, criteria, templates and coaching; your team runs the workshops and owns the register.

• Drive™: managed support

  Our consultants lead the inventory, gap analysis, assessment workshops and treatment planning, with your owners approving decisions.

• Sustain™: after go-live or certification

  Scheduled reassessments, new AI systems brought into scope and management reporting, so the method stays current.

• Automate™: Effivity

  The AI risk register, treatment actions and reviews run in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training where ISO/IEC 42001 applies, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Where certification to a related standard is chosen, certification decisions remain with the independent certification body.

Often combined with

Standards organisations pair with ISO/IEC 23894

• EU AI ActEU AI Act compliance consulting: classify each AI system, document high-risk requirements and transparency duties, and prepare conformity assessment evidence.
• ISO/IEC 38507ISO 38507 AI governance and requirements explained: the 2022 guidance for boards on AI use, why no certificate exists and how Sterling puts it into practice.
• ISO/IEC 42001ISO/IEC 42001 certification consulting for AI governance: risks and impacts assessed, treated and evidenced, then supported through the certification audit.
• ISO/IEC 42005ISO 42005 guidance on AI system impact assessment: what ISO/IEC 42005:2025 covers, its structure, how to put it into practice and how Sterling helps.
• ISO/IEC 42006ISO 42006 explained: the requirements for bodies that audit and certify ISO/IEC 42001 AI management systems, how accreditation works and what to check.
• ISO/IEC 5338ISO/IEC 5338 AI life cycle processes explained: the 2023 process groups, what they ask of AI teams, why there is no certificate and how Sterling helps.