# 6.3.4 Defining risk criteria

The organization states how much risk, and of what kinds, it is prepared or not prepared to take, and fixes criteria for judging how significant a risk is (ISO 31000:2018, 6.3.4), considering: the kinds of uncertainty, tangible or intangible, that can affect outcomes and objectives; how consequences and likelihood are defined and measured; timing factors; whether measurement is consistent; how a level of risk is arrived at; how several risks together or in sequence are handled; and the organization's capacity. The step before 6.3.4 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.3.4
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The organization states how much risk, and of what kinds, it is prepared or not prepared to take, and fixes criteria for judging how significant a risk is (ISO 31000:2018, 6.3.4), considering: the kinds of uncertainty, tangible or intangible, that can affect outcomes and objectives; how consequences and likelihood are defined and measured; timing factors; whether measurement is consistent; how a level of risk is arrived at; how several risks together or in sequence are handled; and the organization's capacity. For AI the criteria also reflect the Annex A objectives and effects on individuals and society, not only on the organization.

## Where generative AI changes the answer

Risk criteria written for classic IT risk do not name hallucination, prompt injection, data leakage through prompts, or copyright in generated output.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Documented AI risk criteria covering consequence and likelihood scales and the Annex A objectives

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Criteria that measure financial impact only, with no criterion for fairness, safety or privacy

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.