ISO 23894 (ISO/IEC 23894): AI Risk Management Explained (2026)
ISO/IEC 23894 is the international guidance standard for AI risk management. What it covers, how it relates to ISO 42001 and NIST AI RMF, whether you can certify against it, and how to put it into practice.
ISO/IEC 23894:2023 is the international guidance standard for AI risk management — it applies the ISO 31000 risk-management playbook to the specific risks AI creates, across the full AI lifecycle.
The point most people miss: ISO 23894 is guidance, not a certifiable standard. You can't get "ISO 23894 certified." It's the methodology; ISO 42001 is the certifiable management system that methodology plugs into.
It structures AI risk work into the familiar loop — establish context, identify, analyze, evaluate, treat, monitor — but forces AI-specific risk sources: training data, model behavior, drift, misuse, opacity, and the sensitive data AI systems ingest and emit.
In practice, the hardest inputs are an honest AI system inventory (including shadow AI) and visibility into what sensitive data your AI actually touches — which is discovery and data-security work before it is paperwork.
Strac supplies those inputs: AI discovery finds the AI in use, Strac's AI data security controls the sensitive-data risk, and Strac Comply turns both into evidence for a 42001 program.
What Is ISO/IEC 23894?
ISO/IEC 23894:2023 — formally Information technology — Artificial intelligence — Guidance on risk management — answers one question: how do you run a disciplined risk-management process when the thing you're managing is AI?
It takes ISO 31000 (the general risk-management standard organizations already know) and adapts it to AI: same process skeleton, but with AI-specific risk sources, AI-specific stakeholders (people affected by model decisions, not just the business), and risk assessment integrated across the AI lifecycle from design and data collection through deployment, monitoring, and retirement.
Three things it is not:
Not certifiable. There is no ISO 23894 certificate. Auditors can assess whether your risk process follows it, usually inside an ISO 42001 certification.
Not a control catalog. It tells you how to run the risk process, not which controls to implement — 42001's Annex A and your security stack supply those.
Not only for model builders. Organizations using AI — deploying copilots, agents, and AI features on business data — face most of the same risk sources and are squarely in its intended audience.
What the Standard Covers
The process will feel familiar to anyone who has run ISO 31000; the substance is where AI changes things:
Context — inventory your AI systems and their purposes, and identify who is affected by them (customers, employees, the public — not just the org).
Risk identification — the AI-specific sources: training and input data quality, bias, model opacity, hallucination and misuse, drift over time, security of the AI supply chain, and sensitive data exposure — what confidential, regulated, or personal data flows into prompts, training sets, connectors, and outputs.
Risk analysis and evaluation — likelihood and consequence with AI's wrinkle: behavior changes as data, models, and usage change, so point-in-time analysis decays.
Risk treatment — controls across the lifecycle: data governance, human oversight, access control, monitoring, and technical enforcement like redacting sensitive data before it reaches a model.
Monitoring and review — continuous, because AI risk is continuous: new tools appear, agents get new connectors, usage shifts.
ISO 23894 vs. ISO 42001 vs. NIST AI RMF
ISO 23894
ISO 42001
NIST AI RMF
What it is
Risk-management guidance
Certifiable management system (AIMS)
Voluntary framework
Certifiable?
No
Yes
No
Role
The how of AI risk
The governance wrapper that requires risk management
Alternative/complementary risk vocabulary
Best use
Method for your risk clauses
The certificate buyers ask for
US-market alignment
The practical pattern in 2026: run your AI risk process per 23894, operate it inside a 42001 AIMS, and map to NIST AI RMF where US customers ask. One risk register, three framework labels. For how the certifiable layer works end to end, see the ISO 42001 certification guide.
✨ Putting ISO 23894 Into Practice
The inventory auditors ask for: every AI tool, agent, and MCP server in use — and the sensitive data flowing through each.
The guidance is readable; the inputs are the work. Three make or break it:
A real AI inventory. Risk management over an incomplete inventory is theater. That includes the unofficial layer — employees' AI tools and agents wired into SaaS through connectors — which is why discovering AI agents and shadow AI is step zero.
Data-flow truth. The dominant enterprise AI risk is sensitive data reaching models ungoverned — pasted into prompts, uploaded as files, or pulled in through MCP connectors. You can't score that risk without seeing it, and you can't treat it with policy documents; it takes enforcement — detect, then redact, mask, warn, or block.
Treatment that leaves evidence. A 42001 auditor (or a customer) will ask how treatments actually operate. Controls that log their own enforcement — every detection, redaction, and block — close the loop between the risk register and reality. That's the design behind Strac's AI data security layer and the evidence flowing into Strac Comply.
Risk treatment that proves itself: sensitive data is blocked, redacted, masked, or vaulted before the AI ever sees it.
✨ From Risk Register to Running Controls with Strac
ISO 23894 programs rarely fail at identification — they fail at the last two steps, treatment and monitoring, where the register meets reality. Strac closes that loop:
Treatment you can point to — for the dominant risk (sensitive data reaching AI ungoverned), Strac enforces the mitigation itself: redact, mask, block, or vault at the browser, endpoint, and MCP layer. The risk owner's “treatment” column references a running control, not an intention.
Monitoring that is genuinely continuous — 23894's monitor-and-review phase assumes AI risk changes weekly; Strac's discovery and per-action logging track new tools, new connectors, and shifting data flows without a quarterly re-survey.
A register that feeds the AIMS — findings and control events flow into Strac Comply, so the same work powers your ISO 42001 clauses when you take the certifiable step.
The risk loop, operationalized: one platform watching the AI estate your register describes.
🌶️ Spicy FAQs for ISO 23894
Is ISO 23894 certifiable?
No — ISO/IEC 23894 is a guidance standard, so there's no such thing as an ISO 23894 certificate. Organizations follow its methodology and, when they want an auditable credential, certify their AI Management System under ISO 42001, which requires AI risk management and points to 23894 as the natural way to do it.
What is the difference between ISO 23894 and ISO 42001?
ISO 23894 tells you how to run AI risk management (the process); ISO 42001 defines the certifiable management system around your AI governance (policy, roles, impact assessments, Annex A controls, audits). They're designed to work together: 42001 requires risk management, 23894 supplies the method. Most programs implement both as one effort.
Who should use ISO 23894?
Anyone who needs disciplined AI risk management: AI vendors, obviously, but equally enterprises deploying AI tools and agents on business data. If your organization is answering AI questionnaires, preparing for ISO 42001, or aligning to the EU AI Act's risk-management expectations, 23894 is the reference methodology.
How does ISO 23894 relate to ISO 31000?
It's ISO 31000 applied to AI. Same process architecture — context, identification, analysis, evaluation, treatment, monitoring — extended with AI-specific risk sources (data quality, bias, opacity, drift, misuse, sensitive-data exposure) and AI-specific stakeholders. Teams with an existing 31000-based ERM program can extend it rather than build a parallel one.
What are the biggest AI risks ISO 23894 helps manage?
The recurring enterprise set: sensitive and regulated data flowing into AI systems ungoverned, biased or poor-quality training data, opaque model decisions affecting people, model drift, misuse of AI tools by employees, and third-party AI supply-chain exposure. For most companies using (rather than building) AI, the data-exposure risk dominates — and it's the one that's technically enforceable today.
The Bottom Line
ISO 23894 is the missing method between "we should manage AI risk" and a defensible program: ISO 31000 discipline, rebuilt for AI's moving parts. Use it as the engine inside an ISO 42001 management system, feed it a truthful AI inventory and real data-flow visibility, and treat the top risk — sensitive data reaching models — with enforcement that proves itself.
Book a demo to see how Strac discovers your AI surface, protects the data flowing through it, and turns both into audit-ready risk evidence.
No — ISO/IEC 23894 is a guidance standard, so there's no such thing as an ISO 23894 certificate. Organizations follow its methodology and, when they want an auditable credential, certify their AI Management System under ISO 42001, which requires AI risk management and points to 23894 as the natural way to do it.
What is the difference between ISO 23894 and ISO 42001?
ISO 23894 tells you how to run AI risk management (the process); ISO 42001 defines the certifiable management system around your AI governance (policy, roles, impact assessments, Annex A controls, audits). They're designed to work together: 42001 requires risk management, 23894 supplies the method. Most programs implement both as one effort.
Who should use ISO 23894?
Anyone who needs disciplined AI risk management: AI vendors, obviously, but equally enterprises deploying AI tools and agents on business data. If your organization is answering AI questionnaires, preparing for ISO 42001, or aligning to the EU AI Act's risk-management expectations, 23894 is the reference methodology.
How does ISO 23894 relate to ISO 31000?
It's ISO 31000 applied to AI. Same process architecture — context, identification, analysis, evaluation, treatment, monitoring — extended with AI-specific risk sources (data quality, bias, opacity, drift, misuse, sensitive-data exposure) and AI-specific stakeholders. Teams with an existing 31000-based ERM program can extend it rather than build a parallel one.
What are the biggest AI risks ISO 23894 helps manage?
The recurring enterprise set: sensitive and regulated data flowing into AI systems ungoverned, biased or poor-quality training data, opaque model decisions affecting people, model drift, misuse of AI tools by employees, and third-party AI supply-chain exposure. For most companies using (rather than building) AI, the data-exposure risk dominates — and it's the one that's technically enforceable today.
Discover & Protect Data on SaaS, Cloud, Generative AI
Strac provides end-to-end data loss prevention for all SaaS and Cloud apps. Integrate in under 10 minutes and experience the benefits of live DLP scanning, live redaction, and a fortified SaaS environment.
.avif){kind=icon}
.gif)
.webp)
