# 5.1 General

The framework's job is to build risk management into the organization's important activities and functions, and ISO 31000:2018, 5.1 applies. The artefact behind the answer is governing body's stated AI risk appetite and the delegation to management. Test it on the 5.1 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.1
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The framework's job is to build risk management into the organization's important activities and functions, and ISO 31000:2018, 5.1 applies. Risk management gathers what the organization needs in order to decide on and deal with risk: the governing body fixes overall risk appetite and objectives and hands the work of finding, assessing and treating risk to management. ISO/IEC 38507 covers the governance questions raised when an organization builds, buys or uses AI (new opportunities, a possibly different risk appetite, new policies for responsible AI) and can sit alongside this document's processes in the iterative integration that ISO 31000:2018, 5.2 sets out.

## Where generative AI changes the answer

A generative AI tool often enters through a team's own credit card, so the framework has to reach uses that never passed a procurement gate.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- Governing body's stated AI risk appetite and the delegation to management
- Governance policy for responsible use of AI

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- AI risk managed by a project team with no governing-body appetite set
- Governance of AI (ISO/IEC 38507) and risk management run as unrelated activities

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.