# 6.5.3 Preparing and implementing risk treatment plans

Treatment plans set out how the chosen options will be put into effect, so that everyone involved understands the arrangements and progress can be tracked (ISO 31000:2018, 6.5.3): the reasons for the choice, who is accountable for approving and carrying it out, the actions, the resources, how performance will be measured, the constraints, what is reported and monitored, and when actions happen. The step before 6.5.3 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.5.3
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Treatment plans set out how the chosen options will be put into effect, so that everyone involved understands the arrangements and progress can be tracked (ISO 31000:2018, 6.5.3): the reasons for the choice, who is accountable for approving and carrying it out, the actions, the resources, how performance will be measured, the constraints, what is reported and monitored, and when actions happen. For AI the plans fit into the system's development and operating plans and its life cycle stages.

## Where generative AI changes the answer

A treatment plan that names the control but not the owner, the date and the evidence is a wish list that an auditor cannot test.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Treatment plans for AI risks with owners, actions and timing

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- Treatments agreed in a workshop and never planned or tracked

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.