Why It Matters
Recognized risk-management backbone. Complements ISO 42001 management systems focus.
At a Glance
Requires
Who Must Comply
- Organizations implementing AI risk management
Obligations fall on:
Safety Provisions
- AI risk identification, analysis, evaluation, treatment
- Lifecycle framing (design → deployment → monitoring)
- Documentation for audits/procurement
Primary Source
ISO
https://www.iso.org/standard/77304.html
View on map
International
Focus Areas
Cite This
APA
International. (2023). ISO/IEC 23894:2023 — AI Risk Management Guidance.
Related Regulations
ISO 42001
First certifiable international standard for AI management systems. Uses Plan-Do-Check-Act methodology. Third-party certification available; major AI systems have achieved certification.
UNESCO AI Ethics
Global normative framework adopted by all 193 UN Member States. Policy Area 8 (Health and Social Wellbeing) directly addresses mental health AI.
OECD AI Due Diligence
Non-binding OECD guidance applying the OECD's six-step responsible business conduct (RBC) due-diligence process to enterprises across the AI value chain, providing practical recommendations for identifying, preventing, mitigating, and accounting for adverse human-rights and societal impacts of AI systems.
UN/ITU AI & Child Rights Statement
Non-binding multilateral statement signed by thirteen UN and international organisations setting out principles for protecting children's rights in the design, deployment, and governance of AI systems, including provisions on harmful content, age assurance, transparency, and child-rights impact assessments.
CA SB 1276
Amends California's sexual-exploitation-of-a-child offence (Penal Code Section 311.3) so that it covers digitally altered or artificial-intelligence-generated matter depicting a person under 18 engaged in sexual conduct, and adds knowingly downloading, streaming or accessing such matter through electronic or digital media to the prohibited conduct. It makes the same extension to the definition of sexual exploitation that triggers mandated reporting under the Child Abuse and Neglect Reporting Act (Section 11165.1).
CA SB 503
Requires developers and deployers of AI clinical decision support systems used by health facilities, clinics and physician practices to make reasonable efforts to identify systems with a known or reasonably foreseeable risk of biased impacts on people with protected characteristics. Developers must mitigate those risks and give deployers an intended-use and risk statement plus documentation on training data, evaluation and data governance; deployers must regularly monitor the systems and mitigate.
Last updated February 17, 2026. Verify against primary sources before relying on this information.