# 6.7 Recording and reporting

The process and what comes out of it are written down and reported (ISO 31000:2018, 6.7), so that activities and results are shared across the organization, decision-makers have information, risk management gets better, and dealings with stakeholders, including those accountable for risk, are supported. The step before 6.7 supplies its input, so run both together.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause 6.7
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

The process and what comes out of it are written down and reported (ISO 31000:2018, 6.7), so that activities and results are shared across the organization, decision-makers have information, risk management gets better, and dealings with stakeholders, including those accountable for risk, are supported. For AI the organization decides what to record about each system's risks and treatments and what regulators, customers and affected people need to be told.

## Where generative AI changes the answer

The record that matters is the one that lets someone reconstruct why an output was accepted, months later, with the versions that produced it.

## Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use.

## Evidence an auditor samples

- Records of AI risk assessments and treatments; reports to stakeholders and regulators

## The test you can run

Ask for one completed assessment for a live use, with its criteria, its analysis and its treatment decision.

## Common failures

- AI risk decisions with no record of who decided what and why

## Before the draft publishes

Run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.