# 6.4.1 General

Risk assessment covers identification, analysis and evaluation together, done methodically, repeatedly and with stakeholders, using their knowledge and the best information available (ISO 31000:2018, 6.4.1). For AI it is redone whenever the system, its data or its uses change, and it draws on the AI objectives and risk sources of Annexes A and B. The step before 6.4.1 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.4.1
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Risk assessment covers identification, analysis and evaluation together, done methodically, repeatedly and with stakeholders, using their knowledge and the best information available (ISO 31000:2018, 6.4.1). For AI it is redone whenever the system, its data or its uses change, and it draws on the AI objectives and risk sources of Annexes A and B.

## Where generative AI changes the answer

The assessment has to be able to say what the system did with a specific input, which means the corpus, prompt version and model version are part of the record.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- AI risk assessment records repeated across the life cycle

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- One assessment at design with none after retraining

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.