# 6.4.3.2 Assessment of consequences

The organization assesses what each identified risk would do: how critical the impact would be, the tangible and intangible effects on the organization, on individuals and on society, and the basis used to judge the overall impact. The artefact behind the answer is consequence assessment with criticality and tangible and intangible impacts. The step before 6.4.3.2 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.4.3.2
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The organization assesses what each identified risk would do: how critical the impact would be, the tangible and intangible effects on the organization, on individuals and on society, and the basis used to judge the overall impact.

## Where generative AI changes the answer

Consequences are easiest to understate when the output is only advisory, and that is exactly when a reviewer stops checking it.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Consequence assessment with criticality and tangible and intangible impacts

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Intangible impacts such as loss of trust ignored

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.