# 5.7.2 Continually improving

The organization keeps making the framework, and the way the process is woven into the organization, more fit for purpose, more adequate and more effective, drawing up plans and tasks as gaps and opportunities come to light (ISO 31000:2018, 5.7.2). Test it on the 5.7.2 question at the next framework review.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 5.7.2
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The organization keeps making the framework, and the way the process is woven into the organization, more fit for purpose, more adequate and more effective, drawing up plans and tasks as gaps and opportunities come to light (ISO 31000:2018, 5.7.2). For AI, risks first discovered in use, what worked and what failed across the AI field, and new research all feed that improvement.

## Where generative AI changes the answer

The improvement loop is only real if a bad output is traced back to the assessment, the criteria or the control that should have caught it.

## Who it binds

Top management, the AI risk owner and the functions that supply resources and communication.

## Evidence an auditor samples

- Improvement actions traced to lessons from AI systems in use

## The test you can run

Ask for the risk register entry for the use. If there is none, the framework has not reached it.

## Common failures

- Incidents from AI systems never fed back into the framework

## Before the draft publishes

Check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.