# 6.4.2.4 Identification of potential events and outcomes

The organization should identify the events that the risk sources can give rise to and the outcomes they can produce for the assets identified, including outcomes the system's designers did not intend and outcomes that emerge from its interaction with people and other systems. The step before 6.4.2.4 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.4.2.4
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The organization should identify the events that the risk sources can give rise to and the outcomes they can produce for the assets identified, including outcomes the system's designers did not intend and outcomes that emerge from its interaction with people and other systems.

## Where generative AI changes the answer

The credible events are concrete: a fabricated citation in a regulated filing, a customer record pasted into a public tool, a jailbreak that releases a restricted answer.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Event and outcome scenarios per AI system

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Only failure events considered, with misuse and emergent behaviour omitted

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.