ISO/IEC 23894 AI Risk Assessment & Treatment Plan
Build an AI risk register with risk sources, consequences, 1–5 likelihood and impact ratings and a treatment for each risk — modify, avoid, share or retain — and see your highest-scoring AI risks at a glance.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- ISO/IEC 23894 gives guidance on applying established risk management practice to the particular risks of AI systems.
- The register scores each risk as likelihood × impact, bands it critical, high, medium or low, and lists the three highest-scoring risks.
- It flags high or critical risks that are retained without treatment or have no owner.
- Twenty process checks cover context, criteria, AI-specific risk sources, treatment, residual acceptance and monitoring.
Frequently asked questions
What makes AI risk different from other IT risk?
AI adds risk sources that ordinary IT risk processes often miss: unrepresentative training data, model drift, opaque decisions, the level of automation, learning in operation, adversarial attacks on the model and dependence on third-party models. A good AI risk process names these explicitly.
What do the treatment options mean?
Modify means reducing likelihood or impact with controls. Avoid means not doing the risky activity, or redesigning it. Share means transferring part of the risk, for example by contract or insurance. Retain means accepting it, with documented acceptance by an accountable owner.
Does this reproduce ISO/IEC 23894?
No. The structure and prompts are written in our own words. You need your own copy of the standard to apply it.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.