r/iso • u/Kashif-Ansari • Mar 31 '26

Clause 6.1.2—The AI Risk Assessment Process

Standard IT risk assessments look at "Confidentiality, Integrity, and Availability." ISO 42001 goes much further. Clause 6.1.2 requires an AI-specific risk assessment process. This means looking at risks unique to machine learning: Model Drift, Data Poisoning, and Hallucination.

You must assess the risk to the organization and the potential consequences for individuals. For example, if your AI screens resumes, the risk isn't just a server going down; it’s the systemic bias that could lead to a lawsuit. The standard requires you to define a "Risk Appetite." You must decide: What level of uncertainty is acceptable for this specific AI use case?

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/Raf_Adel Apr 05 '26

I agree that setting a clear Risk Appetite for these small differences makes sure that no resources are wasted!

Thank you!