# 5.5 Implementation

The framework should be implemented through a plan with time and resources attached, by identifying where, when, how and by whom decisions are made, by adjusting decision-making processes where necessary and by making sure the arrangements for managing risk are understood and practised (ISO 31000:2018, 5.5); for AI the plan should cover the decision points across the AI system life cycle where risk is assessed and treated, from inception through design, development, verification, deployment, operation and retirement. Test it on the 5.5 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.5
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The framework should be implemented through a plan with time and resources attached, by identifying where, when, how and by whom decisions are made, by adjusting decision-making processes where necessary and by making sure the arrangements for managing risk are understood and practised (ISO 31000:2018, 5.5); for AI the plan should cover the decision points across the AI system life cycle where risk is assessed and treated, from inception through design, development, verification, deployment, operation and retirement.

## Where generative AI changes the answer

Implementation is where a policy meets the pilot that is already live, and the pilot usually wins unless someone owns the gap.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- Implementation plan placing AI risk decisions at defined life cycle points

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- Framework designed but never applied to a live AI system

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.