# 5.4.5 Establishing communication and consultation

The organization settles and approves how it will communicate and consult in support of the framework (ISO 31000:2018, 5.4.5). In practice the record is communication and consultation plan naming AI-affected stakeholders. Test it on the 5.4.5 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.4.5
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The organization settles and approves how it will communicate and consult in support of the framework (ISO 31000:2018, 5.4.5). For AI that approach has to reach the extra stakeholders AI brings in, such as data subjects and people subject to automated decisions, convey the organization's responsible-AI policies and commitments, and collect those people's views on harms, benefits and the oversight they expect.

## Where generative AI changes the answer

Staff need a route to report a wrong or harmful output that does not require them to know whether it counts as an incident.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- Communication and consultation plan naming AI-affected stakeholders

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- Communication limited to internal teams with affected people never consulted

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.