ISO/IEC 23894 Risk Management Checklist
The 7 steps of the ISO 23894 risk management process, applied to a real AI system — the methodology ISO 42001 assumes you already have, and the direct complement to your NIST AI RMF checklist.
What's included
- Word document with the full table of the 7 risk management process steps
- ISO 23894 vs ISO 42001 comparison table — what each covers and how they relate
- 7-point verification checklist
- Legal Notice
Why this document exists
ISO/IEC 23894:2023 is the reference guidance for managing AI-specific risk — it inherits the structure of ISO 31000 and adapts it to what makes AI different: models that change behavior after deployment, decisions that are hard to explain, and sources of bias that don't exist in traditional software. It isn't certifiable on its own, but it's the methodology ISO 42001 imports for its own risk-management clauses — and in practice, it's the most direct answer to Article 9 of the AI Act's requirement to maintain a documented risk management system.
The 7 steps, one line each
- Communication and consultation: involve affected parties throughout the process, not just at the end.
- Establishing the context: define purpose, scope and acceptable risk criteria specific to the system.
- Risk identification: detect AI-specific risk sources — bias, opacity, performance drift.
- Risk analysis: assess likelihood and impact, accounting for behavior that can change after deployment.
- Risk evaluation: compare against defined criteria and decide what needs immediate treatment.
- Risk treatment: retrain, add human oversight, limit autonomy, or don't deploy.
- Monitoring, review, recording: ongoing vigilance and auditable documentation.
Frequently asked questions
Is ISO 23894 certifiable?
No. ISO/IEC 23894 is a guidance document, with no mandatory clauses and no certification pathway of its own. The related certifiable standard is ISO/IEC 42001, which imports the ISO 23894 process as its risk-management methodology.
Do I need this if I already have the NIST AI RMF checklist?
Both are complementary, not substitutes — they cover the same goal from different frameworks. If you sell to buyers who require one framework or the other, it makes sense to have both.
Does this replace legal advice?
No. It's a working template that organizes and speeds up the risk management process, but it doesn't constitute legal advice or guarantee compliance with any regulatory framework — see the included Legal Notice.
What format is it delivered in?
A Word document with the process tables and verification checklist, plus the Legal Notice, delivered instantly after purchase.