How ISO/IEC 23894 and ISO 31000 Fit Together for AI Risk Management

What each standard covers

ISO 31000 provides principles, a framework and a process for managing risk. It applies to organizations of any type, size or location and to all types of risk. It offers guidelines rather than requirements and is not intended for certification. The 2018 edition places more emphasis on senior management involvement and on integrating risk-based decision making into governance, planning, management, reporting, policies, values and culture.

ISO/IEC 23894:2023, titled Information technology, Artificial intelligence, Guidance on risk management, describes processes for the effective implementation and integration of AI risk management. ISO states that ISO 31000 served as its basis. The practical reading is that 23894 is an application layer: the structure of principles, framework and process is inherited, and the AI-specific guidance sits on top of it.

For a risk leader, this means no second taxonomy and no parallel committee. The existing ERM program remains the home for AI risk, and 23894 informs how each part of that program is adapted for AI systems.

Where 23894 reuses ISO 31000 and where it adds AI guidance

Several framework-level activities in 23894 are carried over from ISO 31000:2018 by reference. These include integration into the organization, roles, authorities and accountabilities, resource allocation, communication and consultation, improvement, and monitoring and review. If your ISO 31000 program already handles these well, the AI work is mostly extending scope, not rebuilding mechanisms.

The AI-specific additions apply that general structure to AI systems: how risk sources are identified, how objectives and criteria are framed, and how the AI system lifecycle is considered during assessment and treatment. Read the published standard for the exact wording and clause numbering, and treat any internal mapping as your own interpretation. The standards do not prescribe specific technical controls.

If your organization also uses the NIST AI RMF, note that it adapts ISO 31000:2018 language, including the idea that AI impacts can be positive, negative or both. A revised crosswalk between ISO/IEC 23894 and the AI RMF, dated August 2025, is listed by NIST and is a reasonable starting point for reconciling terminology. One industry reading maps the AI RMF Measure function to risk assessment and Manage to risk treatment, which is a useful orientation but not an official position.

Turning treatment decisions into enforceable controls

The most common failure in this stage is that a treatment decision exists only as a policy statement or a register entry. A decision such as "sensitive fields must not reach an external model" or "agent actions that change customer records need human approval" is only a treatment if something enforces it where the AI system executes. ISO 31000 and 23894 both expect treatment plans to be implemented and their effectiveness verified, which implies a control that can be observed operating.

Runtime policy enforcement is one way to meet that expectation. Trussed is an example: it enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Each interaction or tool call can be allowed, redacted, blocked, rate limited or escalated for human approval. Policy is enforced at runtime, not reviewed after the fact.

The scope matters. This enforcement acts on individual interactions and tool calls. It applies treatment decisions your risk process has already made. It does not set risk criteria, decide which risks to accept, or assign accountability, and it does not address model lineage or dataset provenance. Other treatment options, such as avoiding a use case, changing a process or sharing risk, remain outside any technical control.

Recording, reporting and what evidence can and cannot show

Recording and reporting is where AI risk programs tend to be thinnest. Auditors and regulators ask what the system was permitted to do, what it did, and whether the control operated. Enforcement that produces records as a by-product of each decision gives the recording stage durable material to work with. Trussed generates continuous audit-ready evidence from enforcement, mapped to frameworks including HIPAA, NAIC, NYDFS, the EU AI Act and NIST, with self-managed deployment in the customer cloud and configurable retention and data residency.

Evidence of that kind supports verification of treatment effectiveness and informs monitoring and review. It shows that a specific control acted on a specific interaction. It does not show that the right risks were identified, that criteria were sensible, or that senior management acted on the results.

Those remain governance responsibilities: senior management involvement, roles and accountabilities, resource allocation, communication and consultation, and improvement. A regulated enterprise needs both layers. The process decides what should happen, and the runtime evidence shows what did.