This case is a fictional scenario for training purposes. The company, people and figures are all made-up examples. No article numbers or statutory limits are given, so check the original text of the law. Screen names and behaviour are as in eiso in November 2026.

The situation

This case started from a customer question posted in the Korean Questions and Answers board under the title "AI risk assessment". The question was one line.

Please show me, with an example, how to do a risk assessment with AI.

The staff answer made two points. Risk assessment can be done with AI in the Risk Assessment step of Management System Operation, and a company that runs several standards can assess the same process from the quality, environmental and OH&S viewpoints at once. Below, the painting-process example in that answer is told as the story of one company.

Company J machines metal parts and finishes them with powder and liquid coating. It has 72 employees (example) and runs ISO 9001, ISO 14001 and ISO 45001. Risk was assessed three times a year.

The painting supervisor explained the same process three times, and the three sheets used different criteria and different numbering. Last year this happened: the quality team proposed raising the thinner ratio to hit the coating thickness, and only three months later, in the OH&S risk assessment, did it become clear that the action increased volatile organic compound emissions and the inhalation exposure of workers in the mixing room. One action had raised the risks of another standard.

The head of the management support team decided to assess the painting process on one sheet.

1. Operation setup: three standards, risk assessment together

In "Use it" of Management System Operation the company chose in order.

• ① Standards to operate: ISO 9001 · ISO 14001 · ISO 45001
• ② Standards to integrate: none ticked (each standard runs on its own)
• ③ Tasks to integrate: "Risk and opportunity assessment"

The standards run separately and only risk assessment is done together. A company that bundles the three standards under ② receives one risk assessment result without choosing ③. A licence is needed for each standard, whether bundled or shared.

2. Inputs: collecting painting-process material from the company folder

The 「Company folder」 was chosen once. eiso reads that folder only inside this browser and uploads nothing. Under Inputs in the Risk Assessment step, the results of earlier steps (context of the organization, legal requirements) were picked up together with the material below.

• Painting process flow chart and work standards (pre-treatment → mixing → painting → drying → inspection)
• Last year's three assessment sheets (quality, environment, OH&S)
• Last year's painting defect summary, abatement equipment log and near-miss records
• List of safety data sheets for paints and thinners

"painting" was written in the Condition field so that painting-process material came first. The step runs even when material is missing, but facts that are not there are not invented; they appear as "(to be confirmed)".

3. Characteristics and Requests

Under Characteristics the company chose 「Risk and opportunity register」 and 「Evaluation criteria (likelihood × impact)」. In the 「Write a prompt」 box on the left it wrote one comment per line.

Painting process only, by sub-process (pre-treatment, mixing, painting, drying)
Quality, environment and OH&S on one sheet, with a separate viewpoint column
Link risks that come from the same cause by number
Also check whether an action raises a risk in another viewpoint

The text produced by 「Create prompt」 was revised once, approved and placed in the Requests field. The first part of the approved request read as follows.

Purpose: assess the risks and opportunities of the painting process from the quality, environmental and OH&S viewpoints at once.
Scope: pre-treatment, mixing, painting, drying. Inspection and shipping are excluded.
Must include: viewpoint column, grouping by common cause, effect of each action on other viewpoints.
Structure and format: one sheet of criteria, one register, one integrated action plan.
To check: figures not found in the material are not invented and are left as to be confirmed.

Excel was chosen under Outputs.

4. A look at the result: one register, the same criteria

Criteria set by the company (example): likelihood (L) and impact (S) are each rated 1 to 5 and multiplied. 16 to 25 is high (act now), 9 to 15 is medium (planned action), 1 to 8 is low (keep current controls). Items with a legal obligation are linked to compliance obligations regardless of score.

With everything on one sheet, things that had been looked at separately became visible.

• R-01, R-03 and R-05 share a cause (C-1, thinner measuring and container control). On the three sheets they were three unrelated items.
• R-02 and R-03 also share a cause (C-2, filters). The quality team saw only contamination defects, the environmental officer only emissions.
• Last year's "raise the thinner ratio" lowered R-01 and raised R-03 and R-05. The result showed this in the column for the effect of an action on other viewpoints.

Requirements that differ by standard were kept apart within the same result. Environmental aspects and OH&S risk are on separate sheets and are linked by the register numbers.

5. Integrated action plan: one action, three risks

Assessed separately, there would have been seven actions (quality 2, environment 2, OH&S 3, example). Grouped by cause they became four, and priority was set by the number and level of the risks each one reduces. The decision and approval of the assessment were made by the company. The management support team reviewed the draft and changed two scores, and the chief executive approved it.

Each action is carried out in the clause 8 operation step of its own standard. Clause 8 operation is written per standard even when standards are run together.

• The viscosity record in A-01 became a control item in "Production and Service Provision" of ISO 9001
• The differential pressure limit in A-02 went to Operational planning (ISO 14001)
• The ventilation and earthing checks in A-03 went to "Risk reduction" of ISO 45001

Progress and reassessment were managed in the Risks and Opportunities Register under the same numbers.

6. Reassessment three months later

After learning on the painting process, the company assessed machining and washing with the same request. When equipment or paint changes, only that process is reassessed.

If you mean the risk of an AI system itself

If "AI risk" in the question title means the risk of an AI system the company uses (ISO/IEC 42001), the route is different. That assessment is done in the AI risk assessment and AI impact assessment steps of ICT Management System Operation. ICT standards (ISO/IEC 42001 and 27001) are run only with each other, so they are chosen separately from the quality, environment and OH&S setup above. For an example, see the AI photo studio case in eiso Case Studies.

Check your own company

• Do you assess the same process separately for each standard?
• Do the sheets use different criteria (levels of likelihood and impact)?
• Are risks with the same cause written separately on different sheets?
• When assessing, do you check whether an action raises a risk in another viewpoint?
• Do action numbers carry through to the register and the operation steps?
• Do you reassess when a process or substance changes?

Costs

• 「Write with AI」 in the management system operation steps shows the amount when pressed and is charged once you agree. An operation licence is needed for each standard. See eiso Pricing for amounts.

See also

• Questions and Answers
• Management System Operation Guide
• Risk Assessment
• Risks and Opportunities Register
• ICT Management System Operation Guide