# C Risk management and AI system life cycle

Annex C (informative) shows, as an example, how the clause 6 process lines up with the stages of an AI system life cycle as ISO/IEC 22989 describes them: at which stages each clause 6 activity takes place (communication and consultation, setting scope and context, assessment, treatment, review and monitoring, and reporting and recording), so an organization can build the process into the way it develops and operates AI systems. Read risk management and ai system life cycle at the life cycle point the system has actually reached.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause C
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

Annex C (informative) shows, as an example, how the clause 6 process lines up with the stages of an AI system life cycle as ISO/IEC 22989 describes them: at which stages each clause 6 activity takes place (communication and consultation, setting scope and context, assessment, treatment, review and monitoring, and reporting and recording), so an organization can build the process into the way it develops and operates AI systems.

## Where generative AI changes the answer

The life cycle view is what stops the assessment ending at deployment, because most generative AI risk appears in operation and use.

## Who it binds

The AI system owner across the life cycle, with the risk owner at each gate.

## Evidence an auditor samples

- The organization's own mapping of risk activities to its AI life cycle stages

## The test you can run

Ask where the use sits on the life cycle and which gate evidence exists for that point.

## Common failures

- Risk management run as a separate cycle from system development

## Before the draft publishes

Place the use on the life cycle, mark where it actually is, and record which risk steps have and have not been done at that point.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.