ISO/IEC 23894 vs ISO 31000: What AI Adds to Enterprise Risk Management

How the two standards relate

ISO 31000:2018 provides principles, a framework and a process for managing risk. It applies to organizations of any type or size and to all types of risk. It is a guideline, not a certifiable standard, although it offers guidance for internal or external audit programmes. The 2018 edition places more emphasis than the 2009 edition on senior management involvement and on integrating risk management into the organization.

ISO/IEC 23894:2023, "Information technology, Artificial intelligence, Guidance on risk management", is published by ISO and describes processes for the effective implementation and integration of AI risk management. A practical way to read it is as an AI-specific extension of the ISO 31000 structure. Your existing program remains the owner of AI risk. The AI guidance changes what you look for and what you record inside that program.

This matters for regulated organizations because the common failure is structural. AI risk gets handled in a separate workstream, with its own templates and its own reviewers, and never reaches the enterprise register that executives and auditors actually read.

ISO 31000 elements and what AI changes

The table follows the ISO 31000 structure and shows where an AI extension applies. Treat it as a working map for your own register, not a clause-by-clause reproduction of either standard.

• Principles: Apply unchanged as the enterprise baseline. AI does not need a competing set of principles.
• Framework: leadership, integration, governance: Same governance structure. Add named ownership for AI systems, data and models, and an explicit approval path for AI risk tolerance.
• Scope, context and criteria: Add AI objectives and criteria: what the system may decide, who can be affected, and what behavior is unacceptable.
• Risk identification: Add AI-specific sources: training and input data, model behavior, and autonomy over actions and tools.
• Risk analysis and evaluation: Outputs are probabilistic and shift with data and model changes, so evaluation needs testing evidence and scheduled reassessment.
• Treatment, monitoring and recording: Treatment must be enforceable at runtime. Monitoring is continuous, and records must show what was actually enforced.

What AI adds that a conventional assessment tends to miss

A conventional ISO 31000 assessment often treats a system as a fixed asset with predictable behavior. AI breaks that assumption in four places.

Data. Training data, retrieval content and user inputs all influence outcomes. Risk can originate in data quality, sensitivity or representativeness, and in what users paste into a prompt. Few asset-based registers capture this.

Model behavior. The same input can produce different outputs, and behavior can change when a model is updated or replaced. Likelihood and consequence estimates therefore need supporting test results and a trigger for reassessment, not a one-time rating.

Autonomy. When a system calls tools, queries internal systems or acts on a user's behalf, the consequence of an error is the action taken, not only the text produced. Risk criteria should distinguish advisory output from actions with side effects.

Lifecycle. Risk changes from design through deployment, operation, change and retirement. Registers that capture risk at approval and never revisit it will drift away from how the system behaves in production.

Mapping the additions to your register and treatment process

Start with the register you already have. Add AI system as a recognized risk object, with fields for the data it uses, the models behind it, the tools it can call and its lifecycle stage. Link each AI risk to the same owners, rating scales and escalation routes as other enterprise risks, so AI appears in the same reporting.

Record risk tolerance explicitly. NIST AI RMF 1.0 can help prioritize risk but does not prescribe risk tolerance. It defines tolerance as the organization's or AI actor's readiness to bear risk to achieve its objectives. Because ISO 31000 and ISO/IEC 23894 are guidance, the organization itself must set and approve tolerance, and auditors will examine your documented process and evidence rather than certification against the standard.

Regulatory planning belongs in the same map. As of November 2026, the Commission states that the Digital Omnibus on AI entered into force on 27 July 2026. The EU AI Act high-risk rules, originally due on 2 August 2026, now apply from 2 December 2027 for stand-alone high-risk AI systems and 2 August 2028 for systems embedded in products. The Commission also says the Act will be evaluated frequently, so keep a review cadence for your regulatory mapping.

Where risk treatment becomes runtime enforcement

A treatment decision such as "personal data must not leave the approved boundary" or "payments above a threshold need a person to approve" is a statement of intent until something applies it to each request. Policy documents and periodic reviews do not stop a single interaction in production.

For AI systems, the practical implementation is policy enforcement in the execution path, with four outcomes per interaction or tool call: allow, redact, block, or escalate for human approval. Each outcome corresponds to a treatment choice. Allow reflects accepted risk within tolerance. Redact and block reduce risk. Escalation keeps a person accountable for decisions above tolerance.

The same enforcement produces the evidence. An auditor can ask what the system was permitted to do, what it did, and who approved exceptions. Records generated by enforcement answer those questions directly and tie back to the register entry that justified the rule.

Trussed enforces policy at the individual interaction and tool-call level across models, agents, tools and MCP servers, and generates audit-ready evidence mapped to the EU AI Act and NIST. Customers run 100+ models under one policy plane. This does not replace risk assessment, model testing or the enterprise register. It covers the step where treatment decisions meet production traffic.