Home / Answers / ISO 25568 or ISO 23894: which do you use?
ISO/IEC DTS 25568 or ISO/IEC 23894: which do you use?
Use ISO/IEC 23894:2023 now. It is the published guidance on managing AI risk and it gives the process, the objectives, the risk sources and the life cycle. ISO/IEC DTS 25568 is a draft that adds generative AI specific guidance. When it publishes, it is read alongside 23894, not instead of it.
Detail
What each document does
Use ISO/IEC 23894:2023 now. It is the published guidance on managing AI risk and it gives the process, the objectives, the risk sources and the life cycle. ISO/IEC DTS 25568 is a draft that adds generative AI specific guidance. When it publishes, it is read alongside 23894, not instead of it.
Why 23894 is the one to use now
The record separates what ISO has published from what it has not. The status, the stage history, the committee and the scope are public. The clause text is not. Every page on this site marks the difference, and the pages are written from the two published standards named in the record. None of them is a requirement of the draft.
How they fit together
Is ISO/IEC 23894:2023 published?
Yes. It is the published guidance on AI risk management, and this site records its 54 units.
Is ISO/IEC DTS 25568 published?
No. It is at stage 50.00 and its clause text is not public.
Do they overlap?
They address the same subject from different angles: 23894 gives the risk process, and the draft adds guidance specific to generative AI systems. A reader uses both.
Open the requirement record Run the free check
Related answers
Not legal advice; does not certify. Last updated: 2026-10-20.