# 6.5.1 General

Risk treatment selects and implements options for addressing risk in an iterative cycle of formulating and selecting options, planning and implementing treatment, assessing its effectiveness, deciding whether remaining risk is acceptable and treating further if not (ISO 31000:2018, 6.5.1); for AI the cycle should continue through operation because treatments applied to a learning system can lose effect. The step before 6.5.1 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.5.1
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Risk treatment selects and implements options for addressing risk in an iterative cycle of formulating and selecting options, planning and implementing treatment, assessing its effectiveness, deciding whether remaining risk is acceptable and treating further if not (ISO 31000:2018, 6.5.1); for AI the cycle should continue through operation because treatments applied to a learning system can lose effect.

## Where generative AI changes the answer

Treatment for generative AI often starts with the cheapest option, which is to narrow the use, and that option is usually available and rarely taken.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Treatment cycle records per AI system including effectiveness checks

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Treatment applied once with no check that it still works

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.