ISO/IEC 23894: AI Risk Management Guidance and How to Apply It to Operational Controls

What ISO/IEC 23894 is and is not

ISO/IEC 23894:2023 is titled Information technology, Artificial intelligence, Guidance on risk management. It is developed under ISO/IEC JTC 1/SC 42 (Artificial intelligence), and ISO describes it as setting out processes for the effective implementation and integration of AI risk management. As of November 2026, the ISO catalogue lists it at stage 60.60, the published stage, and no revision or withdrawal appears in the catalogue entries we reviewed.

The important word is guidance. The document is not a law and not a set of requirements against which an organisation is certified. It does not define risk thresholds, mandatory controls or evidence retention periods. A regulated enterprise that says it follows ISO/IEC 23894 is describing how it structured its approach, not reporting an audit outcome. Describing it as certification or compliance would overstate what the document provides.

How the guidance is organised

The guidance follows the pattern of ISO 31000: principles, a framework, and a process. The principles describe what effective risk management looks like. The framework covers how risk management is integrated into the organisation, including leadership, responsibilities, resources and improvement. The process is the repeatable cycle applied to each AI system or use case, and it is where most operational work happens.

The process runs through establishing context, assessing risk (identification, analysis, evaluation), treating risk, and monitoring and review, with communication and consultation and recording and reporting alongside every step. What ISO/IEC 23894 adds to ISO 31000 is the AI-specific lens: the considerations that make AI risk different from conventional technology risk, such as non-deterministic behaviour and dependence on data and models. Teams should read these considerations from the published text and decide which apply to each system.

One stakeholder comment on NIST's AI RMF drafts mapped Map to communication and consultation plus context, Measure to the iterative risk assessment, and Manage to risk treatment. That is one commenter's reading of draft-era clause numbers, not an official mapping, so check clause references against the published 2023 text.

Where each document fits in an AI risk program

The four documents are complementary rather than competing. The roles below are a practical reading, and each organisation should confirm placement against the texts themselves.

• ISO/IEC 23894: AI-specific guidance on the risk management process, framework and principles. Not certifiable.
• ISO 31000: The general risk management guidance that ISO/IEC 23894 adapts for AI.
• ISO/IEC 42001: A management system standard for AI. Risk management guidance such as 23894 can inform the risk activities inside such a system.
• NIST AI RMF: A functional framework (Govern, Map, Measure, Manage) with a Playbook of suggested, non-mandatory actions.

Using a crosswalk between ISO/IEC 23894 and the NIST AI RMF

Most enterprises end up reporting against more than one framework, so a crosswalk saves duplicated effort. NIST's AI RMF Resource Center lists a revised ISO/IEC 23894 and NIST AI RMF crosswalk dated 14 August 2025, submitted by INCITS/AI. NIST lists its own earlier crosswalk, written against the draft ISO/IEC text and dated January 2023, as superseded.

Two practices follow. First, treat community-submitted crosswalks as aids rather than authoritative mappings. Second, record which edition of the standard and which crosswalk version your program was mapped against, so a later reviewer can reproduce the reasoning. NIST describes Manage as the function in which risks based on Map and Measure outputs are prioritised, responded to and managed. That is the natural meeting point with ISO/IEC 23894 risk treatment.

Which treatment and monitoring activities can run at runtime

Risk treatment decisions are made in committee, but many are applied at the moment an AI system acts. A runtime policy layer in the execution path can apply treatment to individual interactions and tool calls. Trussed enforces policy at that point with five actions: allow, redact, block, rate limit, and escalate for human approval. Each action can be written as the implementation of a documented treatment decision. For example, a decision to reduce exposure of personal data becomes a redact rule, a decision that an agent must not call a particular tool becomes a block rule, and a decision that a high-impact action needs a person's sign-off becomes an escalation.

The discipline is in the mapping. Each rule should reference the risk assessment outcome that justified it, so the chain from identified risk to treatment to enforced action can be shown. Risk acceptance and risk criteria stay with the organisation, because the guidance does not set thresholds and a tool cannot decide them. Runtime enforcement is also only part of treatment. Model selection, data handling, design changes and contractual measures sit outside the execution path.

Monitoring benefits too. Treatment is followed by verification of effectiveness, and the NIST Playbook cites regular assessment of the effectiveness of existing controls, including reports of errors and impacts. Enforcement outcomes such as the volume of blocked calls, redactions and escalations give a measurable signal for that review, once someone owns the review.

What the organisation still has to decide

The guidance provides process structure. It leaves several decisions to you: which systems and tool calls are in scope, risk criteria and tolerances, which treatments to apply, who may accept residual risk, who approves escalations, and how long evidence is kept. Assign owners for each before enabling enforcement, because a block or escalation rule without an accountable owner creates operational friction without governance value.

A sensible sequence is to establish scope and context, run the assessment on a limited set of systems, translate the resulting treatment decisions into versioned policy, and set a review cadence that uses the enforcement record as input. Trussed produces audit-ready evidence from enforcement, mapped to frameworks including NIST, and can be deployed self-managed in the customer cloud with configurable retention and data residency. That evidence supports your ISO/IEC 23894 process but does not by itself establish alignment, certification or compliance.