# B.2 Complexity of environment

AI-related risk source: AI systems that operate in complex, open or changing environments face situations their design and training did not cover, so the environment's complexity is itself a source of risk. The artefact behind the answer is analysis of the operating environment's complexity and coverage by design and test. Use complexity of environment as a prompt in the identification step, not as a finding.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause B.2
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

AI-related risk source: AI systems that operate in complex, open or changing environments face situations their design and training did not cover, so the environment's complexity is itself a source of risk.

## Where generative AI changes the answer

A generative AI system sits in a complex environment of vendors, APIs and retrieved content, and each connection is a place where the risk changes.

## Who it binds

The assessment team that runs identification, and the business owner who knows the use.

## Evidence an auditor samples

- Analysis of the operating environment's complexity and coverage by design and test

## The test you can run

Ask the assessment team to name the risk sources they considered. Compare the list with the ones present in the use.

## Common failures

- Environment assumed to match the training conditions

## Before the draft publishes

Add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.