AI risk management serves the organization's needs through an approach that is integrated, structured and comprehensive, looks at the whole system with every technology, function and effect on the environment and stakeholders, and accepts that AI can bring risks that are new or emergent, with good or bad consequences for objectives, or can shift the likelihood of risks already known. All eight ISO 31000:2018 principles apply, and Table 1 says what each means for AI: integrated, structured and comprehensive, and customized need nothing added; inclusive calls for dialogue with a wide range of internal and external groups, since AI can bring in new stakeholders whose views help on data collection risks, transparency and explainability aims, human oversight, fairness criteria and what counts as bias; dynamic calls for arrangements that spot new risks, trends, technologies, uses and actors, because systems keep learning, customer expectations move fast and AI regulation changes often, and for considering integration with quality, environmental, safety, health, legal or corporate responsibility management systems; best available information means developers following how the systems they built are used afterwards and users keeping records of use for the system's whole life, bearing in mind that history may be thin and tracking may be limited by intellectual property, contract or market terms; human and cultural factors means watching how AI interacts with existing social patterns that bear on equity, privacy, free expression, fairness, safety, security, jobs, the environment and human rights; continual improvement means turning newly found AI risks into improvements and following the wider AI field for successes, failures, lessons and research. Readers are reminded that risk in ISO 31000 covers upside deviation, whereas safety standards use it for harm only.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.