# 5.4.3 Assigning organizational roles, authorities, responsibilities and accountabilities

Authorities, responsibilities and accountabilities for every relevant risk management role should be assigned and communicated at all levels (ISO 31000:2018, 5.4.3); for AI that means defining who is accountable for each AI system across its life cycle, including the roles that own data, models, deployment and human oversight, and making sure the people assigned have the AI-specific competence the role needs. Test it on the 5.4.3 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.4.3
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Authorities, responsibilities and accountabilities for every relevant risk management role should be assigned and communicated at all levels (ISO 31000:2018, 5.4.3); for AI that means defining who is accountable for each AI system across its life cycle, including the roles that own data, models, deployment and human oversight, and making sure the people assigned have the AI-specific competence the role needs.

## Where generative AI changes the answer

Generative AI splits ownership three ways, between the business owner of the use, the technical owner of the model or vendor, and the risk owner, and each needs a name.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- Assigned accountability for each AI system and its data, model, deployment and oversight roles

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- AI system with no named accountable owner
- Accountability assigned to a role with no AI competence

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.