ISO/IEC 23894
Artificial Intelligence (Product/Service) — Guidance on risk management. Provides a framework and process to systematically manage potential risks throughout the entire life cycle of AI systems, from design and development to deployment and disposal.
Library List
Connection with KAIC-1
- Internalizing risk management systems throughout the entire AI system life cycle
- Verifying core trustworthiness elements such as fairness, robustness, and safety for products/services
- Enhancing stakeholder trust through the establishment of accountability and transparency
ISO/IEC 23894 Overview
ISO/IEC 23894 provides specific guidance for organizations to effectively manage risks when providing AI products and services. It evaluates the adequacy of the risk management framework and processes, including risk identification, analysis, evaluation, and treatment.
KAIC-1 certification concretizes and verifies the risk management goals of ISO/IEC 23894 through practical technical tests and operational controls.
- Checking the achievement of 11 core risk management goals, including accountability, expert participation, and data quality
- Testing and verifying fairness (discriminatory decisions), robustness (exceptional situation response), and safety (hazard recognition)
- Evaluating the documentation and implementation of the entire risk management process, including communication, monitoring, recording, and reporting
Crosswalk
Check the mapping between ISO/IEC 23894 requirements and KAIC-1 requirements.
AI Risk Management Framework
Includes activities to establish a system for AI risk management within the organization, integrate it across the enterprise, and continuously improve it.
Key Requirements
- Demonstrating leadership and commitment from top management
- Designing and integrating risk management processes within the organization
- Evaluating framework effectiveness and continuous improvement
KAIC-1 Mappings
Risk Management Process
Procedure for identifying, analyzing, and evaluating risks throughout the product/service life cycle and establishing appropriate treatment plans.
Key Requirements
- Systematic execution of the three stages of risk diagnosis (identification, analysis, evaluation)
- Technical measurement and functional testing for fairness, robustness, and safety
- Communication and consultation, continuous monitoring, and recording activities
KAIC-1 Mappings
Core Risk Management Goals
11 core values for reliable AI required by ISO/IEC 23894.
Key Requirements
- Ensuring accountability, privacy, transparency, and explainability
- Ensuring AI expert participation and quality of training/test data
- Considering security (adversarial attacks), maintainability, and environmental impact