# 5.6 Evaluation

At intervals the organization checks the framework's performance against what it is for, the plans for putting it in place, its indicators and the behaviour expected of it, and judges whether it is still fit to help reach the objectives (ISO 31000:2018, 5.6). Test it on the 5.6 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.6
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

At intervals the organization checks the framework's performance against what it is for, the plans for putting it in place, its indicators and the behaviour expected of it, and judges whether it is still fit to help reach the objectives (ISO 31000:2018, 5.6). For AI the question is whether the framework has kept pace with changes in the organization's AI systems, how they are used and the rules around them.

## Where generative AI changes the answer

Evaluation asks whether the risk work changed what the organisation deploys, not whether the workshop happened.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- Periodic evaluation of the AI risk management framework with indicators

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- Framework never re-examined after the first AI deployment

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.