# 5.3 Integration

ISO 31000:2018, 5.3 applies with nothing AI-specific added: integration begins with understanding how the organization is structured and what surrounds it, risk is handled throughout that structure, each person has a part in it, and governance and leadership determine how deeply AI risk management shapes decisions. Test it on the 5.3 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.3
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

ISO 31000:2018, 5.3 applies with nothing AI-specific added: integration begins with understanding how the organization is structured and what surrounds it, risk is handled throughout that structure, each person has a part in it, and governance and leadership determine how deeply AI risk management shapes decisions.

## Where generative AI changes the answer

The integration test is whether a generative AI use appears in the enterprise risk register at all, or only in the team that bought it.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- AI risk management embedded in the organization's governance, strategy and decision-making processes

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- AI risk handled in a silo outside the enterprise risk framework

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.