Skip to main content
ControlFrameby LockedIn Labs
Framework library

Requirements & evidence

ISO/IEC 23894

International guidance for integrating AI-specific risk management into organizations that develop, provide, deploy, or use AI systems. It complements ISO/IEC 42001 and is guidance, not a standalone certification.

Edition on record
2023
Edition published
Source last checked

Understand the scope

What the framework covers.

The library records this framework for AI, technology, all sectors, across global. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.

Areas of requirement

  • AI risk-management principles
  • AI risk-management process
  • Organizational integration
  • Monitoring and review

The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.

Source access and licensing

Licensed standard — purchase from ISO or a national member body and obtain software-use rights before verbatim ingestion.

Prepare with context

The evidence behind
the requirements.

Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.

A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.

ControlFrame availability

Framework reference available

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

How availability is determined

ISO/IEC 23894 is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.

Metadata only; licensed AI risk-management guidance is not ingested, normalized, or released as a product module.

Follow the source

Editions and transitions.

These are the editions recorded in the library, checked August 30, 2026. Confirm the applicable edition with the authority before beginning an assessment.

  • 2023Current edition on record

Check the basis

Sources you can follow.

Verified against the issuing authority’s own publication. Source verification was recorded on August 30, 2026.

Catalog provenance and record details

Framework record: iso-23894-2023.

Source artifact: acquisition required.

Parsed catalog: Not ingested.

Control families as published: AI risk-management principles · AI risk-management process · Organizational integration · Monitoring and review.

Record last updated: August 30, 2026.

Common questions

A closer look.

What is ISO/IEC 23894?

International guidance for integrating AI-specific risk management into organizations that develop, provide, deploy, or use AI systems. It complements ISO/IEC 42001 and is guidance, not a standalone certification.

Who does ISO/IEC 23894 apply to?

ISO/IEC 23894 applies to AI, technology, all sectors, global, per ISO/IEC 23894:2023.

What is the current version of ISO/IEC 23894?

The current edition is 2023, issued by ISO/IEC 23894:2023 and published 2023-02-06. Source: https://www.iso.org/standard/77304.html.

What does an assessment under ISO/IEC 23894 require?

No control catalog has been ingested for ISO/IEC 23894 yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.

At a glance

ISO/IEC 23894

2023

Framework reference
Authority and edition tracked
Evidence preparation
Framework reference available
Source confidence
Primary authority

A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.

Continue exploring

Related frameworks.

ISO/IEC 42005

Also applies to AI · International guidance for repeatable AI-system impact assessments across the system lifecycle. It complements ISO/IEC 42001, ISO/IEC 23894, and applicable AI laws; it is not an AI certification by itself.

EU AI Act

Also applies to AI · The EU's risk-tiered regime for AI systems — prohibited practices, high-risk obligations, general-purpose model duties, and transparency requirements.

ISO/IEC 42001

Also applies to AI · The first certifiable management system standard for AI — the ISO 27001 shape applied to how an organization builds and operates AI systems.

Shared Assessments SIG

Also applies to all sectors · The licensed Standardized Information Gathering questionnaire used for risk-based third-party due diligence across security, privacy, resilience, and operational domains. SIG responses are assessment inputs—not a certification, attestation, or independent assurance opinion.

Make the requirements
part of the work.

Explore how ControlFrame can organize ISO/IEC 23894 requirements, evidence preparation, and review for your assessment scope.

Request a walkthrough
ISO/IEC 23894 | ControlFrame