ISO/IEC 23894¶

In one sentence¶

ISO's AI-specific risk-management guidance — an AI overlay on ISO 31000 (general risk management). Companion to ISO/IEC 42001.

What it adds¶

23894 doesn't define a management system (42001 does). It gives the program a shared risk vocabulary: identification, analysis, evaluation, treatment, monitoring — applied to AI-specific risks (data, model, deployment, third-party).

Regulus bindings¶

Clause	Regulus mechanism
CL-6.3 (identify)	`model-risk-tier`
CL-6.4 (analyse)	`model-risk-tier`
CL-6.6 (treat)	`dual-control-kill-switch`
CL-6.7 (monitor)	`audit-trail` + observability

When to activate¶

When your program already uses ISO 31000 and you want the AI-specific overlay. Typically alongside iso-42001:

regulus:
  governance:
    frameworks: [iso-42001, iso-23894]

Citation¶

ISO/IEC 23894:2023 — https://www.iso.org/standard/77304.html