Using the assessment results, set out a process for treating AI risk that will: choose treatment options; determine every control needed and check them against Annex A so nothing necessary is missed; consider the relevant Annex A controls; identify any controls needed beyond Annex A; consider Annex B guidance; produce a statement of applicability listing the necessary controls with justification for inclusion or exclusion; and draw up an AI risk treatment plan. Designated management must approve the plan and accept residual risk; the necessary controls must align with the 6.2 objectives, be documented, be communicated internally and be accessible to interested parties where suitable. Keep documented information about the process.
This control maps to 40 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained
NIST-CSF-GV.RM-06 A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated
NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established
You are reading one control. How much of ISO/IEC 42001:2023 have you already done?
ISO/IEC 42001:2023 6.1.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.