# B.4 Level of automation

AI-related risk source: The degree to which the system acts without human involvement determines how far a wrong output can propagate before anyone intervenes, so the level of automation and the human oversight around it are a source of risk. Use level of automation as a prompt in the identification step, not as a finding.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause B.4
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

AI-related risk source: The degree to which the system acts without human involvement determines how far a wrong output can propagate before anyone intervenes, so the level of automation and the human oversight around it are a source of risk.

## Where generative AI changes the answer

The level of automation decides whether a bad output is a draft someone reads or an action already taken.

## Who it binds

The assessment team that runs identification, and the business owner who knows the use.

## Evidence an auditor samples

- Documented level of automation and the human control points

## The test you can run

Ask the assessment team to name the risk sources they considered. Compare the list with the ones present in the use.

## Common failures

- Full automation with no defined intervention point

## Before the draft publishes

Add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.