ISO/IEC 23894 vs. ISO 42001: AI Risk Management Standards Compared

Scope and Purpose: Guidance vs. Certifiable Requirements

ISO/IEC 23894:2023 and ISO/IEC 42001:2023 were both developed under ISO/IEC JTC 1/SC 42, the joint technical committee responsible for AI standardization, but they serve different functions in an enterprise governance program. ISO/IEC 23894 is a guidance document. It adapts the risk management principles and process defined in ISO 31000 to AI-specific contexts, covering context establishment, risk assessment, risk treatment, monitoring, and communication. Organizations cannot be certified against it; it exists to inform how an organization thinks about and structures AI risk. ISO/IEC 42001, by contrast, specifies requirements for establishing, implementing, maintaining, and improving an AI management system (AIMS), and it is certifiable through accredited bodies. It follows the ISO Harmonized Structure used by standards such as ISO/IEC 27001, meaning its clauses cover context, leadership, planning, support, operation, performance evaluation, and improvement. Within that structure, 42001 requires organizations to operate an AI risk assessment process and an AI risk treatment process, but it does not itself define the methodology in detail.

Key Structural Differences

The two standards are best understood as two functions of the same governance effort: one defines how to think about AI risk, the other defines what a management system must demonstrate.

How the Two Standards Interrelate

ISO/IEC 42001's core clauses require that risk management activity be operational and evidenced, but the standard deliberately does not prescribe a single mandatory methodology. This is where ISO/IEC 23894 most directly applies. Its process steps (establishing context, conducting risk assessment, selecting risk treatment, and monitoring outcomes) map onto 42001's risk assessment and risk treatment clauses, and onto the Annex A controls covering AI system impact assessment and risk assessment. Organizations are free to use ISO 31000 directly, an internal methodology, or ISO/IEC 23894 as the basis for this work. In practice, because 23894 was written specifically for AI contexts rather than general enterprise risk, it tends to be the more direct fit for satisfying 42001's risk-related requirements without significant adaptation.

Where Documentation Gaps Emerge

A common failure pattern is treating ISO/IEC 42001 as a checklist exercise rather than building the underlying risk process that 23894 describes. Certification audits assess whether risk management is operational and evidenced, not whether a specific external guidance document was consulted. Organizations that skip a structured risk methodology and attempt to satisfy 42001's clauses retroactively often find gaps in risk assessment and treatment documentation that surface during internal audit or certification review. Mapping 23894's process steps explicitly to 42001 clause numbers and Annex A controls reduces duplication between a risk register and management system documentation. Existing ISO 31000-based enterprise risk programs do not need to be replaced; they can typically be extended to incorporate AI-specific considerations from 23894 rather than run as a parallel process.

Governance Practices for Combined Implementation

• Certification requires ongoing internal audit and management review of the AI risk process, not a one-time assessment.
• Clarify whether 23894 is the organization's chosen risk methodology reference, since 42001 does not mandate this pairing.
• Reconcile overlap between 23894-based risk registers and 42001 Annex A control evidence to avoid duplicate governance artifacts.
• Scope certification statements explicitly by AI system and risk process, since 23894 guidance is broader than any single certified AIMS boundary.