# 6.4.2.1 General

Risk identification finds, recognizes and describes the risks that might help or prevent achieving objectives, using relevant, appropriate and current information (ISO 31000:2018, 6.4.2); for AI it is broken into identifying assets and their value, risk sources, potential events and outcomes, existing controls and consequences, and should consider risks to the organization, to individuals and to society. The step before 6.4.2.1 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.4.2.1
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Risk identification finds, recognizes and describes the risks that might help or prevent achieving objectives, using relevant, appropriate and current information (ISO 31000:2018, 6.4.2); for AI it is broken into identifying assets and their value, risk sources, potential events and outcomes, existing controls and consequences, and should consider risks to the organization, to individuals and to society.

## Where generative AI changes the answer

A generative AI risk assessment starts from the use and the people affected, not from the model, because the same model carries different risk in different uses.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Risk identification record structured by assets, sources, events, controls and consequences

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Risks identified as a flat list with no link to assets or sources

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.