External and internal context

The process context comes from understanding the setting in which the organization pursues its objectives (ISO 31000:2018, 6.3.3). For an AI system that setting includes its social, legal and contractual surroundings, the stakeholders with their needs and expectations, the data it relies on, and the organization's own AI capabilities and limits. The step before 6.3.3 supplies its input, so run both together.

What it asks

The process context comes from understanding the setting in which the organization pursues its objectives (ISO 31000:2018, 6.3.3). For an AI system that setting includes its social, legal and contractual surroundings, the stakeholders with their needs and expectations, the data it relies on, and the organization's own AI capabilities and limits.

Where generative AI changes the answer

The internal context for generative AI includes which vendor holds the data, where inference runs and what the contract says about model changes.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.3.3 the named role is the owner of context statement covering the AI system's societal, legal, contractual and data environment.

Evidence an auditor normally samples

• Context statement covering the AI system's societal, legal, contractual and data environment

The test you can run

Compare context statement covering the AI system's societal, legal, contractual and data environment with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Context that omits the legal position of automated decision-making

Before the draft publishes

For 6.3.3, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is context statement covering the AI system's societal, legal, contractual and data environment.

Where this sits against the draft

6.3.3 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.3.3 (external and internal context) with this record and note the change in the register.