ISO/IEC 42001, Clause 6.1.2, requires a comprehensive approach to addressing risks and opportunities. The organization must not only identify them but also plan actions to address them. Crucially, this clause mandates that the organization shall plan "how to: a) integrate and implement the actions into its artificial intelligence management system processes...; b) evaluate the effectiveness of these actions." This demonstrates a full lifecycle approach, from planning and integration to evaluation, ensuring that the measures taken are actually working as intended.

A. This is incorrect. The standard explicitly requires the organization to integrate and implement the actions into its AIMS processes (Clause 6.1.2).

C. This is incorrect. The standard explicitly requires the organization to evaluate the effectiveness of the actions taken (Clause 6.1.2).

D. This is incorrect. The standard requires the organization to move beyond identification to plan and implement actions to address the identified risks.

1. ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, Clause 6.1.2 (Planning actions to address risks and opportunities).

2. ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, Clause 8.1 (Operational planning and control).