ISO/IEC 5338:2023 — Information technology — Artificial intelligence — AI system life cycle processes - ISO | Regulations.AI - The Site on AI Laws and Regulations

Overview

ISO/IEC 5338:2023 is an international standard that provides a comprehensive framework for defining and managing the life cycle processes of Artificial Intelligence (AI) systems. Published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), this document offers essential guidance for engineering and managing AI systems from their initial concept through to their eventual retirement. It is specifically designed for AI systems based on machine learning and heuristic systems, integrating AI-specific characteristics into established software and system life cycle models.

The significance of ISO/IEC 5338:2023 lies in its ability to standardize the approach to AI system development and deployment, thereby enhancing efficiency, understanding, and trustworthiness among all stakeholders. It serves as a practical roadmap for organizations seeking to build better software with integrated AI, ensuring proper governance and accountability. By providing a structured set of processes, the standard helps organizations navigate the complexities of AI development, manage risks, assure quality, and demonstrate control throughout the AI system's operational lifespan.

Definitions

For the purposes of ISO/IEC 5338:2023, key terms and definitions are primarily drawn from several foundational international standards. These include ISO/IEC 22989:2022, which provides core concepts and terminology for Artificial Intelligence, and ISO/IEC 23053, which establishes a framework for AI systems using machine learning. Additionally, the document references ISO/IEC/IEEE 15288:2023 for systems and software engineering — system life cycle processes, and ISO/IEC/IEEE 12207:2017 for systems and software engineering — software life cycle processes.

The reliance on these normative references ensures a common vocabulary and taxonomy, which is crucial for avoiding ambiguity in policies, control descriptions, and supplier contracts. This common understanding is essential for effective communication and collaboration among diverse teams, vendors, and auditors involved in the development and deployment of AI systems. By standardizing terminology, ISO/IEC 5338:2023 facilitates clearer documentation, better governance, and more consistent evaluation of AI systems, particularly when auditing or certifying against related standards like ISO/IEC 42001.

Governance and Institutional Framework

ISO/IEC 5338:2023 was developed under the auspices of ISO/IEC JTC 1/SC 42, the Joint Technical Committee 1, Subcommittee 42, dedicated to Artificial Intelligence. This subcommittee is the world's premier technical committee for AI standardization, established to address the urgent need for comprehensive international standards in AI applications, machine learning, and big data analytics. SC 42 serves as the focal point and proponent for JTC 1's standardization program on AI, providing guidance to other ISO and IEC committees developing AI applications.

SC 42 operates with a broad mandate to develop standards that ensure AI systems operate safely, ethically, and effectively across global markets, fostering innovation and building trust in AI technologies. Its program of work encompasses the entire AI ecosystem, including foundational AI standards, data standards, big data and analytics, AI trustworthiness, use cases, governance implications, computational approaches, and testing of AI systems. The committee's formation represents a pivotal moment in AI governance, bringing together global expertise from over 62 nations to create unified standards that address ethical and societal concerns, risk management, and technical robustness in AI systems.

Key Provisions

ISO/IEC 5338:2023 defines a structured set of processes and associated concepts for describing the life cycle of AI systems, specifically those based on machine learning and heuristic systems. The standard provides processes that support the definition, control, management, execution, and improvement of AI systems across all their life cycle stages. These stages typically span from initial requirements and data readiness through to verification, validation, deployment, monitoring, and eventual retirement.

The document is built upon existing software and system life cycle processes defined in ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207, but it incorporates specific modifications and additions tailored to the unique characteristics of AI. This includes clarifying checkpoints for AI particularities such as data provenance, model testing, drift monitoring, and human oversight. It provides guidance on roles, activities, and work products relevant to AI system engineering and management, ensuring that organizations have a comprehensive framework to manage the complexities inherent in AI development and operation.

Scope and Application

ISO/IEC 5338:2023 is broadly applicable to organizations and projects involved in the development, acquisition, provision, or use of AI systems, particularly those employing machine learning and heuristic approaches. It is designed to be used by a diverse range of entities, including AI system developers and engineers, systems engineers working with AI components, AI project managers, and organizations with formal software or system development processes. The standard's processes can be integrated within an organization or a specific project to guide the entire AI system life cycle.

The standard's scope extends to various application domains, recognizing that AI is transforming industries such as healthcare, finance, manufacturing, and customer service. It is adaptable to diverse environments and aims to ensure alignment with industry best practices while addressing the unique challenges and considerations inherent in AI development. When an element of an AI system comprises traditional software or a traditional system, the life cycle processes from ISO/IEC/IEEE 12207 and ISO/IEC/IEEE 15288 can be seamlessly applied to implement that specific element, fostering interoperability and synergy between AI-specific and established methodologies.

Implementation Framework

Implementing ISO/IEC 5338:2023 involves integrating its process guidance into an organization's existing software and system development practices. The standard is not intended to be an isolated framework but rather an extension of established methodologies, building on known software best practices. It provides a structured approach for engineering and managing AI solutions, offering considerations for risk management, quality assurance, project management, data engineering, model engineering, continuous validation, and human resources.

Organizations can use ISO/IEC 5338 as a checklist of attention points for AI, structuring activities and artifacts throughout the AI system's life cycle. It complements the broader Artificial Intelligence Management System (AIMS) defined by ISO/IEC 42001:2023, which sets certifiable requirements for governing AI policies, roles, risk, human oversight, and continuous improvement at an organizational level. While ISO/IEC 42001 defines the "what" for AI governance, ISO/IEC 5338 provides the "how-to" for managing individual AI systems throughout their life, ensuring that technical competence is coupled with proper governance.

Monitoring and Evaluation

Although ISO/IEC 5338:2023 primarily defines the processes for the AI system life cycle, it inherently supports robust monitoring and evaluation activities throughout an AI system's existence. By standardizing the various stages from requirements to retirement, the document facilitates the establishment of clear checkpoints and metrics for assessing performance, quality, and adherence to defined specifications. This includes considerations for continuous validation, drift monitoring, and ensuring that data provenance and model testing are adequately addressed.

The framework encourages organizations to set quality targets and trust goals, which are then assessed and verified at different stages of the life cycle. This continuous assessment helps in identifying and mitigating issues such as bias, security vulnerabilities, and safety concerns. By providing a structured approach to managing the AI system life cycle, ISO/IEC 5338 contributes to an organization's ability to demonstrate control over its AI systems, supporting compliance and accountability. It also helps in feeding findings back into governance oversights, aligning with principles of continuous improvement and responsible AI deployment.

Relationship to Other Instruments

ISO/IEC 5338:2023 is deeply integrated within a broader ecosystem of ISO/IEC standards for Artificial Intelligence. It is built upon and complements several foundational standards, including ISO/IEC/IEEE 15288 (System life cycle processes) and ISO/IEC/IEEE 12207 (Software life cycle processes), providing AI-specific modifications and additions.

Crucially, ISO/IEC 5338 works in conjunction with other key standards developed by ISO/IEC JTC 1/SC 42:

ISO/IEC 42001:2023 (AI Management System): While 42001 sets the organizational requirements for an AI Management System, 5338 provides the detailed life cycle processes for individual AI systems within that management framework.
ISO/IEC 23894:2023 (AI Risk Management): 5338's life cycle processes incorporate risk management guidance from 23894, ensuring that AI-specific risks are identified, analyzed, and treated throughout the system's life.
ISO/IEC 22989:2022 (AI Concepts and Terminology): 5338 relies on 22989 for a common vocabulary, ensuring consistency in definitions across the AI life cycle.
ISO/IEC 23053 (Framework for AI Systems Using Machine Learning): 5338 builds on 23053, which describes how ML components fit into AI system architectures, providing a reference lifecycle skeleton.
ISO/IEC TR 24028:2020 (Trustworthiness in AI): The life cycle processes in 5338 contribute to achieving the trustworthiness characteristics outlined in 24028, such as reliability, safety, security, and privacy.
ISO/IEC 25059:2023 (Quality model for AI systems): 5338 helps set and achieve quality targets for AI systems, aligning with the quality attributes and measures defined in 25059.

This interconnected suite of standards provides a comprehensive and coherent approach to AI governance and technical practices.

International Alignment

ISO/IEC 5338:2023 plays a vital role in fostering international alignment in AI governance and development practices. As an international standard developed through a collaborative global effort involving experts from over 30 countries, it provides a shared language and common benchmarks for organizations worldwide. This global compatibility is crucial for reducing implementation costs, accelerating time-to-market, and ensuring consistent performance of AI systems regardless of their geographic deployment.

The standard's development by ISO/IEC JTC 1/SC 42, the leading international committee for AI standardization, ensures that it addresses diverse cultural, regulatory, and technological contexts while maintaining universal applicability. By aligning with ISO/IEC 5338, organizations can demonstrate their commitment to responsible AI development and deployment, which is increasingly important as global regulations evolve. This alignment helps build trust with customers, regulators, and stakeholders, and facilitates cross-border cooperation and trade in AI technologies.

Implementation Timeline

Milestone	Date	Status
Publication	2023-07-25	In Force

Adoption and Endorsement

Entity	Date	Status
International Organization for Standardization (ISO)	2023-07-25	Adopted
International Electrotechnical Commission (IEC)	2023-07-25	Adopted
ISO/IEC JTC 1/SC 42 (Artificial Intelligence)	2023-07-25	Developed and Adopted

Sources and References

Source	Type
ISO/IEC 5338:2023 - Information technology — Artificial intelligence — AI system life cycle processes	Official Organization Publication Portal
ISO/IEC JTC 1/SC 42 - Artificial intelligence	Official Organization Publication Portal
ISO/IEC 22989:2022 - Information technology — Artificial intelligence — Artificial intelligence concepts and terminology	Official Organization Publication Portal
ISO/IEC 23053:2022 - Information technology — Artificial intelligence — Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML)	Official Organization Publication Portal
ISO/IEC 42001:2023 - Information technology — Artificial intelligence — Management system	Official Organization Publication Portal

ISO/IEC 5338:2023 offers a practical, standardized framework for organizations to manage the entire lifecycle of Artificial Intelligence (AI) systems, ensuring their responsible development and deployment from initial concept through to eventual retirement. This international standard applies to anyone involved in creating, acquiring, providing, or using AI systems, especially those built on machine learning or heuristic approaches. This includes AI developers, engineers, project managers, and organizations with established software or system development processes.

The standard defines a structured set of processes for AI systems, integrating AI-specific considerations into existing software and system development models. Its core purpose is to guide organizations through the complexities of AI development and operation, covering crucial checkpoints such as: - Data provenance and readiness - Model testing and validation - Drift monitoring - Human oversight

By following these processes, organizations can better manage risks, assure quality, and demonstrate control over their AI systems throughout their operational lifespan. This standard became effective on July 25, 2023, upon its publication and adoption by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

Unlike a government regulation, ISO standards do not carry direct legal penalties. However, the "teeth" of this standard come from its ability to enhance trustworthiness and accountability. Adhering to ISO/IEC 5338 helps organizations build trust with customers and regulators, improve efficiency, reduce risks, and demonstrate a commitment to responsible AI. It also supports certification against related standards, such as ISO/IEC 42001 for AI Management Systems, by providing the "how-to" for managing individual AI projects within a broader governance framework.

A key practical point to remember is that this standard isn't a standalone, revolutionary framework. Instead, it builds upon and modifies existing software and system engineering best practices. Organizations should integrate its guidance into their current development methodologies rather than treating it as an entirely separate process. It focuses on the technical lifecycle of *individual AI systems*, complementing organizational-level AI governance.

ISO AI System Life Cycle Processes

Summary

Plain English