# 6.4.3.1 General

Analysis aims to understand each risk, what it is and how it behaves, and where suitable its level, looking at uncertainties, sources, consequences, likelihood, events, scenarios, and the controls in place and how well they work (ISO 31000:2018, 6.4.3). The artefact behind the answer is risk analysis method and results per AI system. The step before 6.4.3.1 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.4.3.1
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Analysis aims to understand each risk, what it is and how it behaves, and where suitable its level, looking at uncertainties, sources, consequences, likelihood, events, scenarios, and the controls in place and how well they work (ISO 31000:2018, 6.4.3). For AI the analysis allows for scarce history and for the chance that the system behaves differently after it has been analysed.

## Where generative AI changes the answer

Analysis of a generative AI risk has to separate what is known about the system from what is assumed about how people will use it.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Risk analysis method and results per AI system

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Level of risk asserted with no analysis of consequence or likelihood

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.