# B.5 Machine learning

AI-related risk source: Learning from data brings risks of its own: data quality and bias, overfitting, concept drift, behaviour that changes with retraining, and outputs that cannot be fully specified in advance. The artefact behind the answer is ML-specific risk register covering data, training, drift and retraining. Use machine learning as a prompt in the identification step, not as a finding.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause B.5
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

AI-related risk source: Learning from data brings risks of its own: data quality and bias, overfitting, concept drift, behaviour that changes with retraining, and outputs that cannot be fully specified in advance.

## Where generative AI changes the answer

Machine learning brings the risk that the system generalises in a way no one specified, including to inputs the test set never contained.

## Who it binds

The assessment team that runs identification, and the business owner who knows the use.

## Evidence an auditor samples

- ML-specific risk register covering data, training, drift and retraining

## The test you can run

Ask the assessment team to name the risk sources they considered. Compare the list with the ones present in the use.

## Common failures

- ML treated as ordinary software in the risk register

## Before the draft publishes

Add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.