Implementation

The framework should be implemented through a plan with time and resources attached, by identifying where, when, how and by whom decisions are made, by adjusting decision-making processes where necessary and by making sure the arrangements for managing risk are understood and practised (ISO 31000:2018, 5.5); for AI the plan should cover the decision points across the AI system life cycle where risk is assessed and treated, from inception through design, development, verification, deployment, operation and retirement. Test it on the 5.5 question at the next framework review.

What it asks

The framework should be implemented through a plan with time and resources attached, by identifying where, when, how and by whom decisions are made, by adjusting decision-making processes where necessary and by making sure the arrangements for managing risk are understood and practised (ISO 31000:2018, 5.5); for AI the plan should cover the decision points across the AI system life cycle where risk is assessed and treated, from inception through design, development, verification, deployment, operation and retirement.

Where generative AI changes the answer

Implementation is where a policy meets the pilot that is already live, and the pilot usually wins unless someone owns the gap.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.5 the named role is the owner of implementation plan placing AI risk decisions at defined life cycle points.

Evidence an auditor normally samples

• Implementation plan placing AI risk decisions at defined life cycle points

The test you can run

Take implementation plan placing AI risk decisions at defined life cycle points and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Framework designed but never applied to a live AI system

Before the draft publishes

For 5.5, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is implementation plan placing AI risk decisions at defined life cycle points.

Where this sits against the draft

5.5 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.5 (implementation) with this record and note the change in the register.