What it is
ISO/IEC 23894:2023, Information technology — Artificial intelligence — Guidance on risk management, was published on 6 February 2023 (26 pages) by ISO/IEC JTC 1/SC 42. It guides organizations that “develop, produce, deploy or use” AI on managing AI-specific risk, and “can be customized to any organization and its context”.
ANSI describes it as intended for use with ISO 31000:2018, the general risk management standard. As guidance, it is not a certifiable requirements standard; certification for AI governance is done against ISO/IEC 42001.
How it fits with other frameworks
| Framework | Type | Reuse for AI tools |
|---|---|---|
| ISO/IEC 23894 | International guidance | Licensed; AI use needs permission |
| ISO/IEC 42001 | Certifiable management system | Licensed; AI use needs permission |
| NIST AI RMF 1.0 | US voluntary framework | US Government work; generally free |
Many teams use the NIST AI RMF as the openly reusable layer and reference ISO/IEC 23894 clauses by number.
Status
ISO’s page lists no revision in progress as of October 2026.
Licence terms
ISO’s licence prohibits accessing, using, or processing ISO publications for machine learning or AI unless expressly authorized under a separate ISO licence, and opts out of the EU text and data mining exception. In short: embedding the text in a vector index is an AI use and needs permission.
Working with ISO/IEC 23894 and AI
- Do not embed or upload the standard without an AI-permitted licence.
- Build your own risk procedure and analyze that with AI.
- Reference clause numbers and titles only.
- Use NIST AI RMF text where you need reusable framework language.
- Record licence decisions.
Common mistakes
- Treating ISO/IEC 23894 as certifiable.
- Assuming embeddings are not “use” of the text.
- Mixing ISO text into a shared knowledge base.
- Overlooking its link to ISO 31000.
Checklist
- ISO text excluded from AI indexes unless licensed
- Own risk procedure documented
- Clause references only
- Open frameworks used for reusable text
- Licence decisions recorded
How AskDona helps
AskDona checks your AI risk procedures and registers, mapping them to clause references and to the NIST AI RMF, with evidence from your documents.
Run a sample AI risk procedure check
AskDona shows the evidence; your risk team decides.
Editor’s note. This article is general information, not legal advice. The “separate permission required” rating comes from our source list and is a first-pass judgment, not a legal opinion.
FAQ
Is ISO/IEC 23894 certifiable? No. It is guidance.
How does it relate to ISO 31000? ANSI describes it as intended for use with ISO 31000:2018.
Can I embed ISO/IEC 23894 in a RAG system? Not without an AI-permitted licence from ISO.
What is a reusable alternative? The NIST AI RMF, a US Government work.
References
All pages opened and checked by October 26, 2026.
| Source | What it supports |
|---|---|
| ISO: ISO/IEC 23894:2023 | Date, pages, abstract |
| ANSI blog: ISO/IEC 23894 | Link to ISO 31000 |
| ISO: Licence agreement | AI and TDM restrictions |
| NIST: AI Risk Management Framework | Open framework comparison |