# 6.5.2 Selection of risk treatment options

Choosing treatment weighs what an option gains against its cost, effort and drawbacks, and options can be combined (ISO 31000:2018, 6.5.2). In practice the record is selected treatment options per AI risk with the rationale. The step before 6.5.2 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.5.2
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Choosing treatment weighs what an option gains against its cost, effort and drawbacks, and options can be combined (ISO 31000:2018, 6.5.2). They are: not starting or stopping the activity so the risk is avoided; accepting or increasing risk in pursuit of an opportunity; eliminating the source; altering likelihood; altering consequences; sharing the risk, for example by contract or insurance; and keeping the risk by an informed decision. For AI, eliminating a source or altering likelihood can mean changing the data, the model, how much is automated or the human oversight, and sharing can mean contract terms with AI suppliers and users.

## Where generative AI changes the answer

The treatment menu runs from avoiding the use, through retrieval and output controls and human review, to transferring risk to a supplier by contract.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Selected treatment options per AI risk with the rationale

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Every AI risk 'accepted' with no option considered

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.