# 5.2 Leadership and commitment

ISO 31000:2018, 5.2 applies. The artefact behind the answer is published statement of commitment to AI risk management. Test it on the 5.2 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.2
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

ISO 31000:2018, 5.2 applies. Since trust and accountability weigh heavily in building and using AI, top management ought to think about how the organization's policies and statements on AI risk and its handling are put across to stakeholders; visible leadership can decide whether stakeholders believe AI is being built and used responsibly, so issuing a statement of commitment to AI risk management is worth considering. Top management also needs to recognize that AI risk work may call for specialist resources and provide them.

## Where generative AI changes the answer

When business units buy generative AI directly, a visible statement from the top is the only thing that tells staff which uses are permitted.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- Published statement of commitment to AI risk management
- Evidence of top management allocating specialized AI risk resources

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- Commitment to responsible AI asserted in marketing with no policy behind it
- AI risk management staffed from the general risk function with no AI expertise

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.