General

Establishing the scope, context and criteria customizes the process so that assessment is effective and treatment appropriate (ISO 31000:2018, 6.3.1); for AI this means being explicit about which AI systems, uses and life cycle stages the process covers and about the AI-related objectives (Annex A) against which risk is judged. The step before 6.3.1 supplies its input, so run both together.

What it asks

Establishing the scope, context and criteria customizes the process so that assessment is effective and treatment appropriate (ISO 31000:2018, 6.3.1); for AI this means being explicit about which AI systems, uses and life cycle stages the process covers and about the AI-related objectives (Annex A) against which risk is judged.

Where generative AI changes the answer

Scoping a generative AI system means drawing the line around the model, the retrieval corpus, the tools it can call and the people who review the output.

Reading it in practice

The general step exists to stop the assessment starting at the model. Start at the use: what decision the output informs, who acts on it, what data goes in and what the system can reach. For a generative AI system the boundary usually runs through a supplier, a retrieval store and a tool integration, so draw all three into the scope or say in writing why one is outside it.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.3.1 the named role is the owner of scope, context and criteria statement for each AI risk assessment.

Evidence an auditor normally samples

• Scope, context and criteria statement for each AI risk assessment

The test you can run

Compare scope, context and criteria statement for each AI risk assessment with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Assessment started with no stated scope or criteria

Before the draft publishes

For 6.3.1, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is scope, context and criteria statement for each AI risk assessment.

Where this sits against the draft

6.3.1 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.3.1 (general) with this record and note the change in the register.