# 6.1 General

The process is the systematic use of policies, procedures and practices for communication and consultation, setting the context, and for the assessment, treatment, monitoring, review, recording and reporting of risk, and belongs inside management and decision-making rather than beside it (ISO 31000:2018, 6.1). The step before 6.1 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.1
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The process is the systematic use of policies, procedures and practices for communication and consultation, setting the context, and for the assessment, treatment, monitoring, review, recording and reporting of risk, and belongs inside management and decision-making rather than beside it (ISO 31000:2018, 6.1). For AI it is run for each AI system and tied to that system's life cycle, at strategic, operational, programme and project level, and allows for the way AI systems change over time.

## Where generative AI changes the answer

A generative AI system can change behaviour between two risk reviews, so the process has to be triggered by a model or corpus change as well as by the calendar.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Documented AI risk management process applied per AI system

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Risk assessed once at project approval and never during operation

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.