Hope all are well...
Coming from an ISO background; I thought this piece should provide a beneficial reference for many.
Need help with your AI ISO Certification? Drop a message; we agree a project and move swiftly.
WhatsApp: +44 7857 709 573
ISO Standards related to AI...
Artificial intelligence has moved from being primarily a technology topic to becoming an organisational capability that affects strategy, operations, decision-making, data, people, risk, quality and governance.
That shift creates a fundamental question for organisations:
How do you manage AI systematically rather than treating every AI initiative as a separate technology project?
The International Organization for Standardization and the International Electrotechnical Commission are developing a growing family of standards that provides an answer.
The ISO/IEC AI standards landscape is particularly important because it does not attempt to solve AI through a single document. Instead, it is developing a connected framework covering different dimensions of AI — from basic terminology and system architecture through to data quality, risk management, lifecycle processes, organisational governance, impact assessment, quality evaluation and management-system certification.
At the centre of this landscape sits ISO/IEC 42001:2023, which specifies requirements for an Artificial Intelligence Management System or AIMS. ISO describes it as the world's first AI management system standard.
But ISO/IEC 42001 should not be viewed in isolation.
An organisation seeking to establish mature AI governance needs to understand how the different standards fit together.
The most useful way to understand the landscape is therefore not as a list of standards but as an AI management architecture.
1. Why AI Needs Its Own Standards
Traditional information technology standards remain highly relevant to AI.
Information security still matters.
Privacy still matters.
Software quality still matters.
Data management still matters.
Business continuity still matters.
Project management still matters.
Risk management still matters.
But AI introduces characteristics that make conventional technology governance insufficient on its own.
AI systems may:
learn from data rather than operate entirely from explicitly programmed rules
generate probabilistic outputs
change behaviour as models or data change
produce different results from apparently similar inputs
introduce bias through training data or system design
make recommendations or decisions that influence people
generate content that appears authoritative despite being incorrect
rely on complex models that are difficult to interpret
operate through continuously changing environments
interact with humans in ways that can create automation bias
depend heavily on data quality
create risks that emerge only when the system is deployed in a particular context
The result is that AI governance cannot simply mean:
"Apply our existing IT controls to AI."
A more mature approach is:
"Integrate AI-specific controls into the organisation's existing governance, risk, quality, security and management structures."
That distinction is fundamental.
ISO/IEC 42001 itself treats an AI management system as a management system for responsible development, provision and use of AI rather than as a purely technical framework.
2. The ISO AI Standards Landscape
The ISO/IEC AI standards ecosystem can broadly be organised into several layers.
Foundational AI concepts
ISO/IEC 22989 — AI concepts and terminology
ISO/IEC 23053 — framework for AI systems using machine learning
AI governance and management
ISO/IEC 38507 — governance implications of organisational AI use
ISO/IEC 42001 — AI management systems
ISO/IEC 42003 — guidance for implementing ISO/IEC 42001, currently under development
AI risk and impact
ISO/IEC 23894 — AI risk management
ISO/IEC 42005 — AI system impact assessment
AI lifecycle
ISO/IEC 5338 — AI system lifecycle processes
AI data quality
ISO/IEC 5259-1 — overview, terminology and examples
ISO/IEC 5259-2 — data quality measures
ISO/IEC 5259-3 — data quality management requirements and guidelines
ISO/IEC 5259-4 — data quality process framework
ISO/IEC 5259-5 — data quality governance framework
AI system quality
ISO/IEC 25059 — quality model for AI systems
ISO/IEC 25058 — measurement and guidance for quality evaluation of AI systems, currently under development
AI trustworthiness, bias and robustness
ISO/IEC TR 24027 — bias in AI systems and AI-aided decision-making
ISO/IEC TR 24028 — overview of trustworthiness in AI
ISO/IEC 24029-1 — robustness of neural networks
ISO/IEC 24029-2 — formal methods for assessing neural-network robustness
ISO/IEC 24029-3 — statistical methods for assessing robustness, currently under development
AI safety
ISO/IEC TR 5469 — functional safety and AI systems
AI assurance and certification
ISO/IEC 42006 — requirements for bodies providing audit and certification of AI management systems
This ecosystem continues to expand. ISO/IEC JTC 1/SC 42 currently has additional AI standards and amendments under development including work relating to generative AI, societal concerns, human oversight, AI capabilities and conformity assessment.
The important message is simple:
ISO AI standards are becoming an interconnected body of knowledge rather than a single AI standard.
3. ISO/IEC 22989 — The Language of AI
Before an organisation can govern AI effectively it needs to agree on what it means by AI.
That is where ISO/IEC 22989:2022 — Artificial intelligence concepts and terminology comes in.
The standard establishes terminology for AI and describes concepts in the field of AI. ISO explicitly identifies its role in supporting communication between different stakeholders and in supporting the development of other standards.
This may sound basic.
It is not.
One of the most underestimated problems in AI programmes is terminology.
A business executive may use the term "AI" to mean a generative AI assistant.
A data scientist may mean a machine-learning model.
An architect may mean an AI-enabled application.
A risk manager may mean an automated decision system.
A product owner may mean an AI-powered feature.
An auditor may ask about the "AI system" without necessarily meaning only the model.
Without common terminology, the organisation can easily end up governing different things while believing that everyone is talking about the same thing.
ISO/IEC 22989 provides the conceptual foundation.
For a Business Analyst this is particularly important.
The BA may be required to translate between:
business stakeholders
data specialists
AI specialists
architects
developers
quality teams
risk teams
governance teams
senior management
A common AI vocabulary becomes an enabling capability for that translation.
4. ISO/IEC 23053 — Understanding AI Systems Using Machine Learning
ISO/IEC 23053:2022 provides a framework for AI systems using machine learning.
It establishes a conceptual framework and shared terminology for describing machine-learning-based AI systems and identifies components and functions within the wider AI ecosystem.
This is important because an AI system is rarely just "the model".
A typical AI solution may contain:
business processes
users
interfaces
data sources
data pipelines
training data
validation data
models
algorithms
infrastructure
monitoring mechanisms
human intervention
downstream systems
governance controls
The model is only one component.
That distinction becomes crucial when analysing AI requirements.
For example:
"The AI model must be accurate."
That sounds like a requirement.
But it is incomplete.
Accurate against what?
For which population?
For which use case?
Measured using which metric?
Against which baseline?
Under what operating conditions?
At what point in the lifecycle?
What happens when the model encounters unfamiliar data?
Who monitors degradation?
What happens when the model produces an uncertain result?
ISO/IEC 23053 encourages a more structured understanding of the AI system rather than treating AI as a black box.
5. ISO/IEC 38507 — AI Governance
If ISO/IEC 42001 is about the AI management system then ISO/IEC 38507:2022 is particularly relevant to organisational governance.
Its purpose is to provide guidance for governing bodies so that AI can be used effectively, efficiently and acceptably within an organisation. It applies to organisations of different sizes and types.
This introduces an important distinction:
Governance is not the same thing as management.
Governance concerns direction and oversight.
Management concerns implementing that direction.
For AI this means senior leadership needs to consider questions such as:
Why is the organisation using AI?
Where should AI be used?
Where should AI not be used?
What risks are acceptable?
Who is accountable?
How are AI investments prioritised?
How is AI performance monitored?
How are stakeholders considered?
How does the organisation know whether its AI portfolio remains appropriate?
AI governance therefore belongs at organisational level.
It should not be left entirely to the technology function.
An organisation can have technically excellent AI systems while still having poor AI governance.
6. ISO/IEC 42001 — The Core AI Management System Standard
If there is one ISO AI standard that business leaders, AI professionals, auditors and Business Analysts should know particularly well it is:
ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System.
This is fundamentally different from a technical AI standard.
It does not tell an organisation how to build a particular neural network.
It does not prescribe one machine-learning algorithm.
It does not tell a data scientist which model architecture to use.
Instead it establishes an organisational management system for responsible AI.
That makes ISO/IEC 42001 comparable in concept to the role played by other management-system standards in their respective domains.
The organisation establishes:
policies
objectives
responsibilities
processes
risk management
controls
monitoring
evaluation
continual improvement
The objective is to create a repeatable organisational capability rather than relying on individual teams to "do AI responsibly".
7. The Management-System Mindset
The biggest conceptual shift introduced by ISO/IEC 42001 is that AI governance becomes a system of management.
This means the organisation should not ask only:
"Is this AI system safe?"
It should also ask:
"Do we have a repeatable organisational process for determining whether our AI systems are appropriate, controlled, monitored and improved?"
That is a much bigger question.
A mature AI management system considers the organisation's:
context
leadership
planning
support
operation
performance evaluation
improvement
The approach is therefore closely aligned with the familiar management-system philosophy of Plan, Do, Check, Act. ISO describes ISO/IEC 42001 as using this continual-improvement approach.
This is one reason ISO/IEC 42001 is strategically important.
It turns AI governance from an aspiration into an organisational operating model.
8. AI Policy
An AI management system needs direction.
That direction comes from organisational policy.
An AI policy can establish principles around matters such as:
responsible AI
acceptable AI use
accountability
human oversight
data quality
AI risk
transparency
security
performance
monitoring
supplier relationships
AI system lifecycle management
But a policy should not become a decorative document.
The real test is whether policy translates into operational controls.
For example:
Policy statement
AI systems must be appropriately monitored.
Operational interpretation
The organisation defines:
what must be monitored
how frequently monitoring occurs
which indicators are tracked
who reviews them
what constitutes an exception
what action is required
how evidence is retained
This is where AI governance becomes real.
9. AI Risk Management — ISO/IEC 23894
AI introduces distinctive risks.
ISO/IEC 23894:2023 — Guidance on risk management provides guidance for organisations developing, producing, deploying or using products, systems and services involving AI. It also describes processes for integrating AI risk management into AI-related activities and functions.
This is important because AI risk should not be treated as an isolated assessment performed immediately before deployment.
AI risk exists across the lifecycle.
Consider:
Before development
Is the use case appropriate?
Is the problem suitable for AI?
Are the data available?
Are the intended outcomes realistic?
During development
Is the training data appropriate?
Are there quality problems?
Could the model introduce bias?
Are performance requirements being met?
Before deployment
Has the system been adequately evaluated?
Are failure modes understood?
Is human oversight appropriate?
Are monitoring mechanisms in place?
During operation
Is performance degrading?
Has the operating environment changed?
Are users behaving differently?
Are unexpected outputs emerging?
During retirement
Is the system still required?
What happens to dependent processes?
What happens to historical data?
Can the system be safely decommissioned?
AI risk management therefore needs to be lifecycle-oriented.
10. AI Impact Assessment — ISO/IEC 42005
Risk is not the same thing as impact.
This distinction is becoming increasingly important.
ISO/IEC 42005:2025 — AI system impact assessment provides guidance for assessing how AI systems and their foreseeable applications may affect individuals, groups and society.
An impact assessment asks questions such as:
Who could be affected?
How could they be affected?
What positive impacts could occur?
What negative impacts could occur?
Are impacts distributed unevenly?
Could particular groups be disproportionately affected?
What assumptions underpin the system?
What controls are needed?
What evidence supports the assessment?
How should impacts be monitored over time?
This broadens the conversation beyond technical performance.
An AI system can be technically accurate while still creating undesirable consequences.
That is why performance, risk and impact should be treated as related but distinct dimensions.
11. AI Lifecycle Management — ISO/IEC 5338
AI systems need lifecycle management.
ISO/IEC 5338:2023 — AI system life cycle processes defines processes and associated concepts for describing the lifecycle of AI systems, including systems based on machine learning and heuristic approaches. It builds on established systems and software lifecycle standards while adding AI-specific processes.
This is highly relevant to project delivery.
A lifecycle approach can cover:
conception
requirements
design
data preparation
development
training
validation
deployment
operation
monitoring
maintenance
modification
retirement
The important insight is that AI governance begins before the model exists and continues after deployment.
That is very different from thinking of governance as an approval gate at the end of a development project.
12. AI Data Quality — ISO/IEC 5259
AI systems are heavily dependent on data.
Poor data can produce poor AI.
This makes the ISO/IEC 5259 family particularly important.
The series covers data quality for analytics and machine learning.
The current family includes:
ISO/IEC 5259-1:2024 — overview, terminology and examples
ISO/IEC 5259-2:2024 — data quality measures
ISO/IEC 5259-3:2024 — data quality management requirements and guidelines
ISO/IEC 5259-4:2024 — data quality process framework
ISO/IEC 5259-5:2025 — data quality governance framework
ISO describes the five-part family as covering data quality from foundational concepts through measurement, management, processes and governance.
This is a major area for Business Analysts.
The BA should be asking:
Where does the AI data originate?
Who owns it?
How is it collected?
How is it transformed?
How is it labelled?
How complete is it?
How accurate is it?
How current is it?
How representative is it?
How is data quality measured?
What happens when data quality falls below acceptable levels?
The phrase "garbage in, garbage out" is old.
For AI it becomes considerably more complicated.
The problem is not simply bad data.
It can be:
incomplete data
inconsistent data
outdated data
unrepresentative data
incorrectly labelled data
duplicated data
biased data
poorly governed data
data affected by changes in the real-world environment
ISO/IEC 5259-2 provides a data quality model and measurable characteristics for assessing data quality in analytics and ML contexts.
ISO/IEC 5259-3 then addresses requirements and guidance for managing that quality through a data quality management system.
ISO/IEC 5259-4 addresses the process framework including data labelling and lifecycle management across different ML approaches.
ISO/IEC 5259-5 takes the subject to governance level.
That progression is significant:
Data concepts → data measures → data management → data processes → data governance
13. AI System Quality — ISO/IEC 25059
AI quality requires its own perspective.
ISO/IEC 25059:2023 — Quality model for AI systems provides an AI-specific extension to the SQuaRE quality standards. It establishes terminology and characteristics for specifying, measuring and evaluating AI system quality.
This matters because conventional software quality assumptions do not always translate neatly to AI.
Traditional software might be expected to produce deterministic behaviour for a defined input.
AI systems can behave probabilistically.
AI quality therefore needs to consider dimensions such as:
functional suitability
performance
reliability
usability
maintainability
safety
security
explainability
robustness
adaptability
data-related characteristics
The exact quality model needs to be interpreted in the context of the applicable standard and system.
But the central principle is powerful:
AI quality must be defined explicitly rather than assumed.
The current ISO catalogue also shows a second edition of ISO/IEC 25059 progressing through the standards process.
14. Bias in AI — ISO/IEC TR 24027
Bias is one of the most visible AI risks.
ISO/IEC TR 24027:2021 — Bias in AI systems and AI-aided decision making addresses bias and provides measurement techniques and methods for assessing bias-related vulnerabilities across AI lifecycle phases.
The important point is that bias is not exclusively a model problem.
It can enter through:
data collection
sampling
labelling
feature selection
model design
training
evaluation
deployment
user interaction
feedback loops
Therefore a simplistic requirement such as:
"The model must be unbiased."
is inadequate.
A better approach is to define:
what bias means in the specific context
which groups are relevant
which measures will be used
what thresholds are acceptable
how bias will be assessed
who reviews the results
what happens when unacceptable differences are identified
15. AI Trustworthiness — ISO/IEC TR 24028
Trustworthiness is broader than accuracy.
ISO/IEC TR 24028:2020 surveys trustworthiness in AI and considers areas including transparency, explainability, controllability, availability, resilience, reliability, accuracy, safety, security and privacy.
This provides an important conceptual framework.
Imagine an AI model that is 98% accurate.
That sounds impressive.
But suppose:
nobody knows when it is likely to fail
users cannot override it
its outputs cannot be traced
its training data cannot be understood
its behaviour deteriorates after deployment
its security controls are weak
Would you call it trustworthy?
Probably not.
Trustworthiness therefore requires a multidimensional assessment.
16. Neural Network Robustness — ISO/IEC 24029
AI systems can behave unexpectedly when conditions change.
The ISO/IEC 24029 series addresses robustness of neural networks.
ISO/IEC TR 24029-1 provides an overview of methods for assessing neural-network robustness. ISO/IEC 24029-2 provides methodology for using formal methods to assess robustness properties.
A further Part 3 covering statistical methods is progressing through the standards process.
This becomes particularly important where AI operates in environments that may differ from training conditions.
A robust AI system should not merely perform well in a controlled test environment.
The organisation needs to understand how performance behaves when:
data distributions change
inputs become unusual
environmental conditions change
users behave unexpectedly
edge cases occur
data quality deteriorates
the operating context changes
Robustness therefore connects AI engineering with AI governance.
17. Functional Safety and AI — ISO/IEC TR 5469
Some AI systems operate in safety-sensitive environments.
ISO/IEC TR 5469:2024 — Functional safety and AI systems addresses the use of AI within safety-related functions, the use of non-AI safety functions around AI-controlled equipment and the use of AI in designing and developing safety-related functions.
This is an important reminder that not every AI system can be evaluated using the same risk tolerance.
An AI-powered marketing recommendation and an AI system influencing safety-related equipment may both use machine learning.
Their assurance requirements are obviously not equivalent.
AI governance must therefore be context-sensitive.
18. ISO/IEC 42006 — Who Audits the AI Management System?
Once organisations begin implementing ISO/IEC 42001 another question appears:
Who determines whether an organisation conforms to the standard?
That is where ISO/IEC 42006:2025 becomes relevant.
ISO/IEC 42006 specifies additional requirements for bodies that audit and certify AI management systems against ISO/IEC 42001. It builds on ISO/IEC 17021-1 and addresses the competence and rigour required for AI management-system certification.
This creates an important distinction.
ISO/IEC 42001 is primarily concerned with the organisation's AI management system.
ISO/IEC 42006 is concerned with the organisations that audit and certify those management systems.
In simplified terms:
42001 = what the organisation must establish
42006 = requirements for bodies assessing and certifying that management system
That distinction is essential when designing an AI assurance programme.
19. ISO/IEC 42003 — Implementation Guidance
The ecosystem is continuing to develop.
ISO/IEC AWI 42003 is currently under development and is intended to provide guidance for implementing ISO/IEC 42001, including competencies for AIMS professionals.
This is particularly interesting for practitioners.
The existence of implementation guidance reflects a broader reality:
Knowing what a standard requires is not the same as knowing how to implement it.
An organisation may understand:
"We need an AI management system."
But implementation requires answers to questions such as:
Who owns it?
What is in scope?
Which AI systems are included?
What evidence is required?
Which processes already exist?
Which processes need to change?
How does AI risk integrate with enterprise risk?
How does AI data quality integrate with data governance?
How does AI quality integrate with testing?
How does AI monitoring integrate with operational monitoring?
These are implementation questions.
20. Generative AI Is Becoming Part of the Standards Landscape
Generative AI has created an additional layer of complexity.
The ISO/IEC JTC 1/SC 42 catalogue currently shows amendments to standards including ISO/IEC 22989 and ISO/IEC 23053 that specifically address generative AI. The amendment to ISO/IEC 23053 is currently in the approval phase.
This is important because generative AI introduces characteristics that differ from many traditional predictive ML applications.
Generative systems may:
generate text
generate images
generate audio
generate video
generate software
transform information
summarise information
answer questions
interact conversationally
invoke tools
produce variable outputs
This creates additional requirements around:
output evaluation
hallucination management
prompt and context management
human review
content provenance
model behaviour
monitoring
system boundaries
user expectations
data handling
model updates
The standards landscape is therefore continuing to develop alongside the technology.
21. Human Oversight
AI does not eliminate the need for human responsibility.
It changes the nature of that responsibility.
Human oversight involves more than having a person somewhere in the process.
A meaningful human-oversight model should answer:
Who monitors the AI?
What are they expected to monitor?
What information do they receive?
What decisions can they override?
When must they intervene?
How quickly must they intervene?
Do they understand the system sufficiently?
Do they have the authority to stop or override the system?
What happens when the AI behaves unexpectedly?
ISO's developing work on human oversight explicitly connects technical controllability with organisational governance and management practices.
This is a useful principle for requirements analysis:
Human oversight should be designed as a control rather than described as a vague intention.
22. The AI Business Analyst
This entire standards landscape has major implications for Business Analysts.
An AI BA cannot simply capture:
"The business wants an AI chatbot."
That is only the beginning.
The BA needs to understand the complete business and control context.
Questions may include:
Business purpose
What business problem are we solving?
Why is AI appropriate?
What happens if AI is not used?
What value is expected?
Stakeholders
Who owns the AI system?
Who uses it?
Who is affected by it?
Who operates it?
Who monitors it?
Who approves changes?
Data
What data does it require?
Where does the data come from?
Who owns the data?
What data quality requirements apply?
How is data labelled?
How frequently does data change?
Model
What does the model do?
What assumptions does it make?
What are its limitations?
How is performance measured?
What constitutes acceptable performance?
Risk
What could go wrong?
What happens if the model fails?
What happens if the model behaves unexpectedly?
What happens if data quality deteriorates?
What happens if the operating environment changes?
Human oversight
Who reviews outputs?
When is human intervention required?
What authority does the human have?
How are interventions recorded?
Monitoring
What is monitored?
How often?
Who reviews the results?
What triggers investigation?
Lifecycle
How is the system changed?
How are models updated?
How are changes tested?
How are previous versions controlled?
How is the AI system retired?
This is why AI Business Analysis is becoming increasingly multidisciplinary.
23. A Practical AI Standards Architecture
A useful way to think about the standards is as a layered architecture.
Layer 1 — Understand AI
Use:
ISO/IEC 22989
ISO/IEC 23053
Purpose:
terminology
concepts
AI system structure
common language
Layer 2 — Govern AI
Use:
ISO/IEC 38507
ISO/IEC 42001
Purpose:
organisational direction
accountability
AI policy
governance
management system
Layer 3 — Manage AI Risk and Impact
Use:
ISO/IEC 23894
ISO/IEC 42005
Purpose:
AI risk
impact
mitigation
monitoring
stakeholder effects
Layer 4 — Manage the AI Lifecycle
Use:
ISO/IEC 5338
Purpose:
lifecycle processes
development
deployment
operation
maintenance
retirement
Layer 5 — Manage AI Data
Use:
ISO/IEC 5259 series
Purpose:
data quality
measurement
data management
labelling
data processes
governance
Layer 6 — Manage AI Quality
Use:
ISO/IEC 25059
ISO/IEC 25058
Purpose:
AI quality characteristics
measurement
evaluation
Layer 7 — Assess Trustworthiness
Use:
ISO/IEC 24027
ISO/IEC 24028
ISO/IEC 24029 series
Purpose:
bias
trustworthiness
robustness
resilience
Layer 8 — Address Safety
Use:
ISO/IEC TR 5469
Purpose:
functional safety
AI-related safety considerations
Layer 9 — Independent Assurance
Use:
ISO/IEC 42006
Purpose:
audit
certification
competence of certification bodies
This layered view is far more useful than memorising a list of ISO numbers.
24. How the Standards Work Together
The real value appears when the standards are connected.
Consider a hypothetical AI system.
The organisation starts with a business requirement.
ISO/IEC 22989 helps establish common AI terminology.
ISO/IEC 23053 helps describe the AI system architecture.
ISO/IEC 38507 helps establish organisational governance considerations.
ISO/IEC 42001 provides the overarching AI management system.
ISO/IEC 23894 supports AI risk management.
ISO/IEC 42005 supports impact assessment.
ISO/IEC 5338 provides lifecycle processes.
ISO/IEC 5259 addresses data quality.
ISO/IEC 25059 supports AI system quality evaluation.
ISO/IEC 24027 addresses bias.
ISO/IEC 24028 provides a trustworthiness perspective.
ISO/IEC 24029 addresses neural-network robustness.
ISO/IEC TR 5469 becomes relevant where functional safety is involved.
ISO/IEC 42006 becomes relevant when certification bodies assess an ISO/IEC 42001 management system.
This is the key insight:
No single ISO AI standard provides the complete answer.
The standards are complementary.
25. ISO/IEC 42001 Should Be the Centre — But Not the Whole Universe
For organisations asking:
"Where should we start?"
ISO/IEC 42001 is usually the logical centre of an AI management programme.
But starting with 42001 does not mean ignoring everything else.
A mature programme might use:
42001 as the management-system backbone
with:
38507 for governance
23894 for AI risk
42005 for impact assessment
5338 for lifecycle management
5259 for data quality
25059 for AI quality
24027 for bias
24028 for trustworthiness
24029 for robustness
and other standards where the particular AI context requires them.
This creates a standards ecosystem rather than a standards checklist.
26. What ISO Standards Do Not Do
It is equally important to understand what ISO standards do not do.
They do not magically make an AI system trustworthy.
They do not guarantee that an AI model will be accurate.
They do not eliminate AI risk.
They do not replace competent people.
They do not replace good engineering.
They do not eliminate the need for testing.
They do not guarantee that an AI system is appropriate for a particular business problem.
And they do not mean that an organisation can simply produce documentation and declare AI governance complete.
The real objective is organisational capability.
Documentation is evidence of a process.
It is not the process itself.
27. The Evidence Mindset
One of the most important lessons from management-system standards is the distinction between saying something and demonstrating it.
An organisation might say:
"We manage AI risk."
The stronger question is:
"Show me how."
Evidence might include:
AI inventories
AI policies
defined roles and responsibilities
risk assessments
impact assessments
data quality assessments
model evaluation results
testing records
monitoring results
incident records
corrective actions
management reviews
training records
supplier assessments
change records
lifecycle documentation
This is where Business Analysts become extremely valuable.
A BA can help transform abstract requirements into:
Requirement → Process → Control → Evidence
That chain is at the heart of effective AI governance.
28. AI Governance Is Not Just an IT Problem
Perhaps the biggest organisational mistake would be to place AI governance entirely within the technology department.
AI affects:
strategy
operations
data
people
customer experience
product development
risk
quality
security
procurement
suppliers
finance
knowledge management
decision-making
AI governance therefore needs cross-functional participation.
Depending on the organisation, this might include:
executive leadership
AI leadership
Business Analysts
data teams
technology teams
information security
quality
risk
compliance
procurement
HR
operations
product management
subject-matter experts
The exact organisational model will differ.
The principle remains the same:
AI is an enterprise capability and therefore AI governance needs an enterprise perspective.
29. A Maturity Model for AI Governance
Organisations can also use the ISO landscape to assess their maturity.
Level 1 — Experimental
AI is being explored by individuals and teams.
limited governance
inconsistent documentation
little central visibility
experimental use cases
informal risk assessment
Level 2 — Emerging
The organisation begins establishing common practices.
AI inventory
AI policy
basic risk assessment
defined responsibilities
initial AI standards
Level 3 — Managed
AI becomes an organisational capability.
formal AI management system
structured lifecycle
documented risk processes
data quality management
defined monitoring
formal governance
Level 4 — Assured
AI processes are consistently evaluated.
measurable controls
documented evidence
impact assessments
structured quality evaluation
systematic monitoring
internal assurance
Level 5 — Optimised
AI governance becomes embedded into organisational management.
continual improvement
integrated risk management
integrated data governance
lifecycle-based assurance
measurable AI performance
management review
mature accountability
proactive identification of emerging AI risks
The objective is not to create bureaucracy.
The objective is to create repeatability, visibility and control without unnecessarily slowing innovation.
30. What an AI Standards Roadmap Could Look Like
An organisation starting from scratch could take a staged approach.
Phase 1 — Establish the foundation
understand ISO/IEC 22989
establish common AI terminology
identify AI use cases
create an AI inventory
identify stakeholders
define organisational AI objectives
Phase 2 — Establish governance
review ISO/IEC 38507
establish AI governance responsibilities
develop an AI policy
define accountability
establish decision rights
Phase 3 — Establish the management system
implement ISO/IEC 42001
define scope
establish objectives
integrate AI risk management
establish operational controls
establish monitoring and review
Phase 4 — Strengthen risk and impact
apply ISO/IEC 23894
introduce AI impact assessment
apply ISO/IEC 42005 where appropriate
establish risk treatment processes
Phase 5 — Strengthen lifecycle management
align AI development with ISO/IEC 5338
establish lifecycle gates
define change management
define monitoring
define retirement processes
Phase 6 — Strengthen data quality
apply ISO/IEC 5259
establish data quality measures
establish data quality processes
establish data governance
Phase 7 — Strengthen technical assurance
apply ISO/IEC 25059
assess bias
assess robustness
assess trustworthiness
establish appropriate quality measures
Phase 8 — Establish assurance
establish internal audit capability
maintain objective evidence
evaluate management-system performance
prepare for independent certification where appropriate
This creates progression rather than attempting to implement everything simultaneously.
31. The Bigger Picture
The most important development in ISO's AI standards landscape is not any individual standard.
It is the movement towards systematic AI management.
AI governance is gradually becoming a discipline that connects:
Strategy
↓
Governance
↓
Management
↓
Risk
↓
Impact
↓
Data
↓
Lifecycle
↓
Quality
↓
Trustworthiness
↓
Monitoring
↓
Assurance
The organisation that understands only the AI model sees technology.
The organisation that understands the entire chain sees an AI operating model.
That distinction will become increasingly important as AI becomes embedded into everyday business processes.
32. The Role of the Business Analyst
For Business Analysts, this creates a particularly interesting opportunity.
The AI BA does not need to become a data scientist.
The AI BA does not need to design neural-network architectures.
The AI BA does not need to build machine-learning algorithms.
But the AI BA increasingly needs to understand how AI fits into an organisational system.
That means understanding:
AI terminology
AI use cases
AI stakeholders
AI requirements
AI data
AI risk
AI impact
AI lifecycle
AI quality
AI monitoring
human oversight
governance
controls
evidence
The BA becomes one of the people who connects the dots.
A model specialist may understand the model.
A data specialist may understand the data.
A governance specialist may understand the controls.
An executive may understand the strategic objective.
The Business Analyst needs to understand how these pieces fit together into a coherent business capability.
That is where the ISO AI standards become particularly valuable.
Conclusion
The ISO AI standards landscape is becoming a substantial body of professional knowledge.
ISO/IEC 22989 establishes common AI concepts and terminology.
ISO/IEC 23053 provides a framework for AI systems using machine learning.
ISO/IEC 38507 addresses organisational governance.
ISO/IEC 42001 provides the central AI management-system framework.
ISO/IEC 23894 addresses AI risk management.
ISO/IEC 42005 addresses AI system impact assessment.
ISO/IEC 5338 addresses AI lifecycle processes.
ISO/IEC 5259 addresses data quality for analytics and machine learning.
ISO/IEC 25059 addresses AI system quality.
ISO/IEC 24027 addresses bias.
ISO/IEC 24028 addresses trustworthiness.
ISO/IEC 24029 addresses neural-network robustness.
ISO/IEC TR 5469 addresses functional safety and AI.
ISO/IEC 42006 addresses the requirements for organisations that audit and certify AI management systems.
And the landscape continues to expand with work covering implementation guidance, generative AI, human oversight, conformity assessment and other emerging AI capabilities.
The central lesson is therefore straightforward:
AI governance is not one document, one policy or one technical control.
It is a management capability.
The ISO standards provide the building blocks for that capability.
For organisations, the challenge is to connect those building blocks into an operating model that allows AI to be developed, acquired, deployed, monitored and improved in a controlled and responsible way.
For Business Analysts, the opportunity is equally significant.
The AI BA/Consultant sits at the intersection of business objectives, requirements, data, technology, risk, governance, lifecycle and organisational change.
Understanding the ISO AI standards therefore provides far more than knowledge of standards.
It provides a framework for understanding how an organisation can manage AI as a business capability.
And that is ultimately the point of the ISO AI standards landscape: not to make AI slower or more bureaucratic, but to make the use of AI more deliberate, measurable, explainable, governable and sustainable.
This article was drafted by AI and checked by the Author.
#ArtificialIntelligence #AI #AIGovernance #AIStandards #ISO #ISO42001 #ResponsibleAI #AIRiskManagement #AIManagement #AICompliance #AIQuality #AITrustworthiness #AIDataQuality #MachineLearning #GenerativeAI #AISafety #AILeadership #BusinessAnalysis #BusinessAnalyst #DigitalTransformation