General

Analysis aims to understand each risk, what it is and how it behaves, and where suitable its level, looking at uncertainties, sources, consequences, likelihood, events, scenarios, and the controls in place and how well they work (ISO 31000:2018, 6.4.3). The artefact behind the answer is risk analysis method and results per AI system. The step before 6.4.3.1 supplies its input, so run both together.

What it asks

Analysis aims to understand each risk, what it is and how it behaves, and where suitable its level, looking at uncertainties, sources, consequences, likelihood, events, scenarios, and the controls in place and how well they work (ISO 31000:2018, 6.4.3). For AI the analysis allows for scarce history and for the chance that the system behaves differently after it has been analysed.

Where generative AI changes the answer

Analysis of a generative AI risk has to separate what is known about the system from what is assumed about how people will use it.

Reading it in practice

The general step for analysis asks the team to separate what it knows about the system from what it assumes about its users. For generative AI the assumption is usually that a human reads the output before it matters. Write that assumption down, name the person, and check it against the workflow. Where the output flows into another system, the assumption is false and the analysis must change.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.3.1 the named role is the owner of risk analysis method and results per AI system.

Evidence an auditor normally samples

• Risk analysis method and results per AI system

The test you can run

Ask for risk analysis method and results per AI system and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• Level of risk asserted with no analysis of consequence or likelihood

Before the draft publishes

For 6.4.3.1, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is risk analysis method and results per AI system.

Where this sits against the draft

6.4.3.1 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.3.1 (general) with this record and note the change in the register.