NZS ISO/IEC 23894:2025
Information technology – Artificial intelligence – Guidance on risk management
This standard offers New Zealand organisations a structured and internationally recognised approach to managing AI risks. Its alignment with existing standards and emphasis on transparency and stakeholder trust supports Aotearoa’s broader goals around ethical innovation, digital trust, and responsible AI deployment. The standard is particularly relevant for sectors such as healthcare, finance, and government, where AI systems increasingly influence decision-making and public outcomes.
This standard was considered for adoption by the P4830 Identical Adoption of Digital Standards Committee which included experts from government, industry, academia, and the private sector, all focused on the responsible use of emerging technologies.
This standard is identical to and has been reproduced from ISO/IEC 23894:2023, Information technology – Artificial intelligence – Guidance on risk management.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$175.16 NZD
|
|
| HardCopy |
$194.63 NZD
|
|
| Networkable PDF |
Price varies
|
|
| Online Library ( Annual subscription) |
Info
Price varies
Online Library subscription information Online library subscriptions provide a cost-effective solution for organisations of any size to access the latest standards, offering 24/7 access to a personalised catalogue. The service ensures subscribers have have the most up-to-date version of selected standards, incluing automatic updates for any amendments or versions. Pricing is dependent on the chosen standards and the number of concurrent users, with discounts applied from the standards PDF price. For customised subscriptions or further inquiries, contact the Online Library team. |
NZS ISO/IEC 23894 2025
Committee representation
Acknowledgement
Copyright
Preface
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Principles of AI risk management
5 Framework
5.1 General
5.2 Leadership and commitment
5.3 Integration
5.4 Design
5.4.1 Understanding the organization and its context
5.4.2 Articulating risk management commitment
5.4.3 Assigning organizational roles, authorities, responsibilities and accountabilities
5.4.4 Allocating resources
5.4.5 Establishing communication and consultation
5.5 Implementation
5.6 Evaluation
5.7 Improvement
5.7.1 Adapting
5.7.2 Continually improving
6 Risk management process
6.1 General
6.2 Communication and consultation
6.3 Scope, context and criteria
6.3.1 General
6.3.2 Defining the scope
6.3.3 External and internal context
6.3.4 Defining risk criteria
6.4 Risk assessment
6.4.1 General
6.4.2 Risk identification
6.4.3 Risk analysis
6.4.4 Risk evaluation
6.5 Risk treatment
6.5.1 General
6.5.2 Selection of risk treatment options
6.5.3 Preparing and implementing risk treatment plans
6.6 Monitoring and review
6.7 Recording and reporting
Annex A (informative) Objectives
Annex B (informative) Risk sources
Annex C (informative) Risk management and AI system life cycle
Bibliography
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
AS/NZS 3802:1997
Data elements and interchange formats - Information interchange - Representation of dates and times
-
AS/NZS 5121:2015
Information technology - Vocabulary - Learning, education and training -
AS/NZS 5813.1:2012
Information technology equipment - Energy performance of computers - Part 1: Methods of measurement of energy performance -
AS/NZS 5813.2:2012
Information technology equipment - Energy performance of computers - Part 2: Minimum energy performance standards (MEPS) for computers
NZS ISO/IEC 23894 2025
Committee representation
Acknowledgement
Copyright
Preface
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Principles of AI risk management
5 Framework
5.1 General
5.2 Leadership and commitment
5.3 Integration
5.4 Design
5.4.1 Understanding the organization and its context
5.4.2 Articulating risk management commitment
5.4.3 Assigning organizational roles, authorities, responsibilities and accountabilities
5.4.4 Allocating resources
5.4.5 Establishing communication and consultation
5.5 Implementation
5.6 Evaluation
5.7 Improvement
5.7.1 Adapting
5.7.2 Continually improving
6 Risk management process
6.1 General
6.2 Communication and consultation
6.3 Scope, context and criteria
6.3.1 General
6.3.2 Defining the scope
6.3.3 External and internal context
6.3.4 Defining risk criteria
6.4 Risk assessment
6.4.1 General
6.4.2 Risk identification
6.4.3 Risk analysis
6.4.4 Risk evaluation
6.5 Risk treatment
6.5.1 General
6.5.2 Selection of risk treatment options
6.5.3 Preparing and implementing risk treatment plans
6.6 Monitoring and review
6.7 Recording and reporting
Annex A (informative) Objectives
Annex B (informative) Risk sources
Annex C (informative) Risk management and AI system life cycle
Bibliography
NZS ISO/IEC 23894:2025
Online Library subscription information
Online library subscriptions provide a cost-effective solution for organisations of any size to access the latest standards, offering 24/7 access to a personalised catalogue. The service ensures subscribers have have the most up-to-date version of selected standards, incluing automatic updates for any amendments or versions. Pricing is dependent on the chosen standards and the number of concurrent users, with discounts applied from the standards PDF price. For customised subscriptions or further inquiries, contact the Online Library team.