General

Risk identification finds, recognizes and describes the risks that might help or prevent achieving objectives, using relevant, appropriate and current information (ISO 31000:2018, 6.4.2); for AI it is broken into identifying assets and their value, risk sources, potential events and outcomes, existing controls and consequences, and should consider risks to the organization, to individuals and to society. The step before 6.4.2.1 supplies its input, so run both together.

What it asks

Risk identification finds, recognizes and describes the risks that might help or prevent achieving objectives, using relevant, appropriate and current information (ISO 31000:2018, 6.4.2); for AI it is broken into identifying assets and their value, risk sources, potential events and outcomes, existing controls and consequences, and should consider risks to the organization, to individuals and to society.

Where generative AI changes the answer

A generative AI risk assessment starts from the use and the people affected, not from the model, because the same model carries different risk in different uses.

Reading it in practice

The general step for identification is a discipline, not a checklist. For each generative AI use, ask what the system can produce, what it can reach, who reads the output and what they do next. Then ask what would have to be true for the output to be wrong and for nobody to notice. Those two questions find more than a taxonomy does, and they leave a record you can defend.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.2.1 the named role is the owner of risk identification record structured by assets, sources, events, controls and consequences.

Evidence an auditor normally samples

• Risk identification record structured by assets, sources, events, controls and consequences

The test you can run

Ask for risk identification record structured by assets, sources, events, controls and consequences and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• Risks identified as a flat list with no link to assets or sources

Before the draft publishes

For 6.4.2.1, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is risk identification record structured by assets, sources, events, controls and consequences.

Where this sits against the draft

6.4.2.1 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.2.1 (general) with this record and note the change in the register.