Home / Requirement record / 6.4.2.6
6.4.2.6
Identification of consequences
The organization should identify the consequences of the events for the organization, for individuals and for society, both tangible and intangible, and the AI-related objectives of Annex A they bear on. The artefact behind the answer is consequence statements per event referencing the affected objectives. The step before 6.4.2.6 supplies its input, so run both together.
- What it asks
- The organization should identify the consequences of the events for the organization, for individuals and for society, both tangible and intangible, and the AI-related objectives of Annex A they bear on.
- Where generative AI changes the answer
- The consequence analysis has to follow the output into the decision it informs, because the harm lands on the person the decision is about.
- Who it binds
- The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.2.6 the named role is the owner of consequence statements per event referencing the affected objectives.
- Evidence an auditor normally samples
- Consequence statements per event referencing the affected objectives
- The test you can run
- Ask for consequence statements per event referencing the affected objectives and for its last review date; an artefact nobody can date is paperwork rather than a control.
- Common failures
- Consequences to individuals and society left out
- Before the draft publishes
- For 6.4.2.6, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is consequence statements per event referencing the affected objectives.
- Where this sits against the draft
- 6.4.2.6 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.2.6 (identification of consequences) with this record and note the change in the register.