General

The framework's job is to build risk management into the organization's important activities and functions, and ISO 31000:2018, 5.1 applies. The artefact behind the answer is governing body's stated AI risk appetite and the delegation to management. Test it on the 5.1 question at the next framework review.

What it asks

The framework's job is to build risk management into the organization's important activities and functions, and ISO 31000:2018, 5.1 applies. Risk management gathers what the organization needs in order to decide on and deal with risk: the governing body fixes overall risk appetite and objectives and hands the work of finding, assessing and treating risk to management. ISO/IEC 38507 covers the governance questions raised when an organization builds, buys or uses AI (new opportunities, a possibly different risk appetite, new policies for responsible AI) and can sit alongside this document's processes in the iterative integration that ISO 31000:2018, 5.2 sets out.

Where generative AI changes the answer

A generative AI tool often enters through a team's own credit card, so the framework has to reach uses that never passed a procurement gate.

Reading it in practice

In practice the framework question is whether a generative AI use that arrived through a team's own subscription is inside the organisation's risk framework at all. Test it by asking for the risk entry, the owner and the last review. If the answer is that the team handles it locally, the framework has not reached the use, and no amount of policy wording changes that.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.1 the named role is the owner of governing body's stated AI risk appetite and the delegation to management.

Evidence an auditor normally samples

• Governing body's stated AI risk appetite and the delegation to management
• Governance policy for responsible use of AI

The test you can run

Take governing body's stated AI risk appetite and the delegation to management and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• AI risk managed by a project team with no governing-body appetite set
• Governance of AI (ISO/IEC 38507) and risk management run as unrelated activities

Before the draft publishes

For 5.1, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is governing body's stated AI risk appetite and the delegation to management.

Where this sits against the draft

5.1 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.1 (general) with this record and note the change in the register.