# 5.4.1 Understanding the organization and its context

Clause 5.4.1 of ISO 31000:2018 applies, and Table 2 lists further external-context factors for an organization working with AI: legal requirements, AI-specific ones included; ethical guidance on designing and using AI and automated systems issued by governments, regulators, standards bodies, civil society, academia and industry groups; sector-specific AI guidance and frameworks; technology developments across the fields of AI; the social and political consequences of putting AI into use, informed by the social sciences; how stakeholders see AI, which opacity or bias can colour; and what stakeholders expect in the way of AI-based products. Test it on the 5.4.1 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.4.1
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Clause 5.4.1 of ISO 31000:2018 applies, and Table 2 lists further external-context factors for an organization working with AI: legal requirements, AI-specific ones included; ethical guidance on designing and using AI and automated systems issued by governments, regulators, standards bodies, civil society, academia and industry groups; sector-specific AI guidance and frameworks; technology developments across the fields of AI; the social and political consequences of putting AI into use, informed by the social sciences; how stakeholders see AI, which opacity or bias can colour; and what stakeholders expect in the way of AI-based products. Internally, the context adds the organization's own AI capability, data, culture and values, and the contracts and network dependencies its AI systems rely on.

## Where generative AI changes the answer

The external context moves faster here than in most risk work: model releases, supplier terms and regulator statements can change inside a quarter.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- Context analysis covering AI-specific law, ethics guidelines, technology trends and stakeholder perceptions
- Register of the organization's AI capabilities, data and dependencies

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- Context analysis that names no AI-specific regulation or guideline
- Stakeholder perception of AI never assessed

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.