# 6.4.2.3 Identification of risk sources

The organization identifies where AI-related risk can come from, starting from the Annex B list: how complex the operating environment is, missing transparency or explainability, how far the system is automated, machine learning, hardware issues, life cycle issues and technology readiness. The step before 6.4.2.3 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.4.2.3
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The organization identifies where AI-related risk can come from, starting from the Annex B list: how complex the operating environment is, missing transparency or explainability, how far the system is automated, machine learning, hardware issues, life cycle issues and technology readiness.

## Where generative AI changes the answer

Risk sources for generative AI sit in the model, the training and retrieval data, the prompt, the integration and the people who rely on the output.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Risk sources identified per AI system against the Annex B list

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Machine learning treated as the only source of AI risk

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.