# 5.4.2 Articulating risk management commitment

Top management and oversight bodies should demonstrate and state their continuing commitment to managing risk through a policy or statement that conveys the organization's objectives for it (ISO 31000:2018, 5.4.2), and for AI the commitment should say how the organization intends to develop and use AI responsibly, which risks it will and will not accept from AI systems, and how that commitment reaches the people who design, buy, deploy and use them. Test it on the 5.4.2 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.4.2
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Top management and oversight bodies should demonstrate and state their continuing commitment to managing risk through a policy or statement that conveys the organization's objectives for it (ISO 31000:2018, 5.4.2), and for AI the commitment should say how the organization intends to develop and use AI responsibly, which risks it will and will not accept from AI systems, and how that commitment reaches the people who design, buy, deploy and use them.

## Where generative AI changes the answer

The commitment has to say which generative AI uses the organisation will accept and which it will not, or the statement says nothing a team can apply.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- AI risk management policy or commitment statement issued by top management

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- No policy statement covering AI at all
- Policy that never reaches the teams building AI systems

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.