ISO/IEC 23894:2023
What is ISO/IEC 23894:2023?
Information technology - Artificial intelligence - Guidance on risk management. Provides guidance on how organizations that develop, produce, deploy, or use products, systems and services that utilize AI can manage risk specifically related to AI. It comprises 54 controls organised across 6 domains, published by ISO/IEC, and applies in International.
How ISO/IEC 23894:2023 maps to other frameworks
All 54 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 6 domains ISO/IEC 23894:2023 groups its controls into
Frameworks that share controls with ISO/IEC 23894:2023
Each of these has at least one control mapped to a control in ISO/IEC 23894:2023. The number is how many ISO/IEC 23894:2023 controls are shared, counted from the mapping graph.
ISO 31000
21 shared controlsISO/IEC 38500:2024
15 shared controlsISO 27005
12 shared controlsISO 19011:2018
10 shared controlsAuthorised Economic Operator (AEO) Programmes - Global Standards
10 shared controlsNIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security
10 shared controlsMTCS (Singapore)
10 shared controlsSSAE 18 - Attestation Standards (SOC Reporting)
10 shared controlsWhere ISO/IEC 23894:2023 overlaps with the standards you already hold
Where to get trained on ISO/IEC 23894:2023
One course in the catalogue covers ISO/IEC 23894:2023 directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What an auditor will ask you for
All 85 ISO/IEC 23894:2023 controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the ISO/IEC 23894:2023 evidence request listWhat ISO/IEC 23894:2023 means in your sector
What ISO/IEC 23894:2023 means for your job
Questions people ask about ISO/IEC 23894:2023
What is ISO/IEC 23894:2023?
How many controls does ISO/IEC 23894:2023 have?
Where does ISO/IEC 23894:2023 apply?
What frameworks does ISO/IEC 23894:2023 map to?
How do I get started with ISO/IEC 23894:2023 compliance?
Query ISO/IEC 23894:2023 programmatically
ISO/IEC 23894:2023, its 54 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
ISO/IEC 23894:2023 API reference and MCP config →What ISO/IEC 23894:2023 requires, control by control
Each page carries the requirement text for one ISO/IEC 23894:2023 control and what an assessor expects to see as evidence.
- 23894-4-1 AI Risk Management Principles
- 23894-5-2 Leadership and Commitment
- 23894-5-3 Integration into Organizational Processes
- 23894-5-4-1 Understanding Organization and Context
- 23894-5-4-2 AI Risk Management Policy
- 23894-5-4-3 Roles, Authorities, Responsibilities
- 23894-5-4-4 Allocation of Resources
- 23894-5-5 Communication and Consultation
- 23894-6-4-2 AI Risk Identification
- 23894-6-4-3 AI Risk Analysis
How ready are you for ISO/IEC 23894:2023?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.