# 6.4.3.3 Assessment of likelihood

The organization should assess the likelihood of each event and its consequences, recognizing that for AI systems historical data can be scarce, that likelihood can change as the system learns or its context shifts, and that the assessment should state its uncertainty. The step before 6.4.3.3 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.4.3.3
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The organization should assess the likelihood of each event and its consequences, recognizing that for AI systems historical data can be scarce, that likelihood can change as the system learns or its context shifts, and that the assessment should state its uncertainty.

## Where generative AI changes the answer

Likelihood for generative AI depends on exposure and on whether anyone gains from breaking the system, not only on the model's own error rate.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Likelihood assessment with its basis and uncertainty stated

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Likelihood scored from intuition with no stated basis

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.