Articulating risk management commitment

Top management and oversight bodies should demonstrate and state their continuing commitment to managing risk through a policy or statement that conveys the organization's objectives for it (ISO 31000:2018, 5.4.2), and for AI the commitment should say how the organization intends to develop and use AI responsibly, which risks it will and will not accept from AI systems, and how that commitment reaches the people who design, buy, deploy and use them. Test it on the 5.4.2 question at the next framework review.

What it asks

Top management and oversight bodies should demonstrate and state their continuing commitment to managing risk through a policy or statement that conveys the organization's objectives for it (ISO 31000:2018, 5.4.2), and for AI the commitment should say how the organization intends to develop and use AI responsibly, which risks it will and will not accept from AI systems, and how that commitment reaches the people who design, buy, deploy and use them.

Where generative AI changes the answer

The commitment has to say which generative AI uses the organisation will accept and which it will not, or the statement says nothing a team can apply.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.4.2 the named role is the owner of AI risk management policy or commitment statement issued by top management.

Evidence an auditor normally samples

• AI risk management policy or commitment statement issued by top management

The test you can run

Compare AI risk management policy or commitment statement issued by top management with the use as it runs today; the gap between the two is the finding to record.

Common failures

• No policy statement covering AI at all
• Policy that never reaches the teams building AI systems

Before the draft publishes

For 5.4.2, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is AI risk management policy or commitment statement issued by top management.

Where this sits against the draft

5.4.2 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.4.2 (articulating risk management commitment) with this record and note the change in the register.