Adapting

The framework is watched and adjusted as circumstances inside and outside the organization change (ISO 31000:2018, 5.7.1). For AI the changes to track include the organization's own systems learning or being retrained, new AI techniques and uses, fast-moving customer expectations and frequently revised AI law and guidance. Test it on the 5.7.1 question at the next framework review.

What it asks

The framework is watched and adjusted as circumstances inside and outside the organization change (ISO 31000:2018, 5.7.1). For AI the changes to track include the organization's own systems learning or being retrained, new AI techniques and uses, fast-moving customer expectations and frequently revised AI law and guidance.

Where generative AI changes the answer

A vendor model update can change behaviour without a change to the organisation's own code, so adaptation cannot wait for the next annual review.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.7.1 the named role is the owner of record of framework adaptations triggered by AI changes.

Evidence an auditor normally samples

• Record of framework adaptations triggered by AI changes

The test you can run

Compare record of framework adaptations triggered by AI changes with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Framework unchanged while the AI estate and its regulation moved

Before the draft publishes

For 5.7.1, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is record of framework adaptations triggered by AI changes.

Where this sits against the draft

5.7.1 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.7.1 (adapting) with this record and note the change in the register.