Summary
- Published by ISO and IEC in February 2023 (Edition 1, 26 pages), written by the joint AI committee ISO/IEC JTC 1/SC 42. The iso.org page shows it as published and current (stage 60.60).
- Per the iso.org abstract (paraphrased): it helps organisations that develop, produce, deploy or use AI products and services manage the risks that are specific to AI, and fold that risk work into their normal AI activities.
- It is guidance, not requirements. It uses "should" language and cannot be certified against on its own. Organisations usually use it as the "how to" behind the risk clauses of ISO/IEC 42001.
- It is adaptable: the abstract says it can be tailored to any organisation and its context.
- The full text is sold by ISO; this note relies only on the free iso.org catalogue page.
Who it applies to
- Nobody by law. Any organisation that chooses to use it: AI developers, providers, deployers and users.
- Not extraterritorial. It becomes relevant to Indian companies through customer contracts, certification audits (ISO/IEC 42001) or regulators who point to it.
Key dates
- ISO/IEC 23894:2023 (Edition 1, 26 pages) published; iso.org gives month only
Full date record
| Date | Event |
|---|---|
| 2023-02 | ISO/IEC 23894:2023 Edition 1 published (iso.org gives month only) |
Penalties and enforcement
- None. There is no certificate for 23894 alone and no regulator enforces it.
- In practice, an ISO/IEC 42001 auditor may look for a risk method; using 23894 is a common way to show one, but the standard does not demand it.
What it means for an Indian company
- Use it as the playbook for SC-AI-005 AI risk assessment and SC-AI-004 AI risk classification and use-case tiering: define your risk criteria, identify AI risks per use case, rate them, choose treatments and review them.
- If you already run an ISO 27001 or ISO 31000 style risk register, extend it with AI risk sources (for example bias, opacity, data drift, misuse) rather than starting a new one.
- Pair with SC-AI-003 AI system inventory (you cannot assess what you have not listed) and SC-AI-040 Board reporting and AI risk metrics (risk results should reach leadership).
- For impact on people and society, the companion standard is ISO/IEC 42005; risk to the organisation (23894) and impact on others (42005) are different lenses.
- Useful evidence for Indian sector rules that ask for AI risk frameworks, such as RBI FREE-AI, even though those rules do not name 23894.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when ISO/IEC 23894 is done.
Glossary
- ISO/IEC JTC 1/SC 42: the joint ISO and IEC committee that writes AI standards.
- Guidance standard: a standard that recommends practices ("should") instead of setting auditable requirements ("shall").
- Risk treatment: the action chosen for a risk, such as reducing, avoiding, transferring or accepting it.
- Stage 60.60: ISO code meaning the standard is published and current.
Key takeaways
- Voluntary international guidance for managing AI-specific risk; no certificate and no penalties.
- Calling it "In Force" or "enforced" is misleading for a voluntary standard.
- Best used as the method behind ISO/IEC 42001 risk clauses and SecComply controls SC-AI-004 and SC-AI-005.
Official sources
- ISO/IEC 23894:2023 catalogue page (iso.org), accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.