Understanding the organization and its context

Clause 5.4.1 of ISO 31000:2018 applies, and Table 2 lists further external-context factors for an organization working with AI: legal requirements, AI-specific ones included; ethical guidance on designing and using AI and automated systems issued by governments, regulators, standards bodies, civil society, academia and industry groups; sector-specific AI guidance and frameworks; technology developments across the fields of AI; the social and political consequences of putting AI into use, informed by the social sciences; how stakeholders see AI, which opacity or bias can colour; and what stakeholders expect in the way of AI-based products. Test it on the 5.4.1 question at the next framework review.

What it asks

Clause 5.4.1 of ISO 31000:2018 applies, and Table 2 lists further external-context factors for an organization working with AI: legal requirements, AI-specific ones included; ethical guidance on designing and using AI and automated systems issued by governments, regulators, standards bodies, civil society, academia and industry groups; sector-specific AI guidance and frameworks; technology developments across the fields of AI; the social and political consequences of putting AI into use, informed by the social sciences; how stakeholders see AI, which opacity or bias can colour; and what stakeholders expect in the way of AI-based products. Internally, the context adds the organization's own AI capability, data, culture and values, and the contracts and network dependencies its AI systems rely on.

Where generative AI changes the answer

The external context moves faster here than in most risk work: model releases, supplier terms and regulator statements can change inside a quarter.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.4.1 the named role is the owner of context analysis covering AI-specific law, ethics guidelines, technology trends and stakeholder perceptions.

Evidence an auditor normally samples

• Context analysis covering AI-specific law, ethics guidelines, technology trends and stakeholder perceptions
• Register of the organization's AI capabilities, data and dependencies

The test you can run

Compare context analysis covering AI-specific law, ethics guidelines, technology trends and stakeholder perceptions with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Context analysis that names no AI-specific regulation or guideline
• Stakeholder perception of AI never assessed

Before the draft publishes

For 5.4.1, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is context analysis covering AI-specific law, ethics guidelines, technology trends and stakeholder perceptions.

Where this sits against the draft

5.4.1 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.4.1 (understanding the organization and its context) with this record and note the change in the register.