ISO/IEC 23894 and 5338 for engineering teams

Engineering teams often meet two ISO/IEC JTC 1/SC 42 documents at once: a risk-management guidance text and a life-cycle process text. They are not the same catalog class as a certifiable management-system standard. This page keeps the live titles: ISO/IEC 23894:2023, Information technology — Artificial intelligence — Guidance on risk management and ISO/IEC 5338:2023, Information technology — Artificial intelligence — AI system life cycle processes. Official catalog pages still say Artificial intelligence and AI. This article uses those names. Super Intelligence (SI) is this site’s own-voice term for current U.S. executive-branch policy; it does not rewrite ISO or IEC titles.

ISO sells the full text. This page quotes public catalog abstracts only. It does not reconstruct unpublished clauses.

ISO/IEC 23894:2023 — risk-management guidance

ISO lists ISO/IEC 23894:2023 as edition 1, published in February 2023, 26 pages, from ISO/IEC JTC 1/SC 42. IEC’s catalog dates publication 6 February 2023. ISO’s lifecycle table records International Standard published on 2023-02-06.

The official abstract says the document provides guidance on how organizations that develop, produce, deploy or use products, systems and services that utilize artificial intelligence (AI) can manage risk specifically related to AI. It aims to assist organizations to integrate risk management into their AI-related activities and functions and describes processes for the effective implementation and integration of AI risk management. ISO adds that the application of this guidance can be customized to any organization and its context.

That audience sentence is the engineering takeaway from the public page: developers, producers, deployers and users. The catalog does not, on that abstract, name an aviation authority, a CMMC level, or a safety integrity level.

The catalog page describes guidance, not a management-system certification scheme. For an organizational AI management system that ISO says organizations may choose certification for, see ISO/IEC 42001 and What auditors ask for in an ISO/IEC 42001 certification audit. This site has not found an official ISO page that says ISO/IEC 23894 is itself certifiable.

ISO separately publishes ISO 31000:2018, Risk management — Guidelines, which provides principles and guidelines for risk management and cannot be used for certification purposes. We cite that sentence from ISO’s own 31000 page. We have not found an official ISO catalog page that states a clause-by-clause relationship between 23894 and 31000, so this article does not invent one.

ISO/IEC 5338:2023 — AI system life cycle processes

ISO lists ISO/IEC 5338:2023 as edition 1, 2023-12, 39 pages, from ISO/IEC JTC 1/SC 42. IEC records publication date 2023-12-20 and the same 39 pages. ISO’s lifecycle table records International Standard published on 2023-12-20.

The official abstract says the document defines a set of processes and associated concepts for describing the life cycle of AI systems based on machine learning and heuristic systems. It is based on ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207 with modifications and additions of AI-specific processes from ISO/IEC 22989 and ISO/IEC 23053. It provides processes that support the definition, control, management, execution and improvement of the AI system in its life cycle stages. Those processes can also be used within an organization or a project when developing or acquiring AI systems.

The same abstract is explicit about traditional elements: When an element of an AI system is traditional software or a traditional system, the software life cycle processes in ISO/IEC/IEEE 12207 and the system life cycle processes in ISO/IEC/IEEE 15288 can be used to implement that element.

That last sentence is the one engineering teams most often need: 5338 does not, on the public abstract, replace 12207 or 15288 for ordinary software or system elements.

The four documents 5338’s abstract names

ISO/IEC 22989:2022, Information technology — Artificial intelligence — Artificial intelligence concepts and terminology, establishes terminology for AI and describes concepts in the field of AI. ISO lists it as edition 1, published 2022-07, 60 pages, from ISO/IEC JTC 1/SC 42. It can be used in the development of other standards and in support of communications among diverse, interested parties or stakeholders and is applicable to all types of organizations (e.g. commercial enterprises, government agencies, not-for-profit organizations).

ISO/IEC 23053:2022 is titled Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML). ISO lists edition 1, published 2022-06, 36 pages, from ISO/IEC JTC 1/SC 42. ISO’s catalog page says it provides a conceptual framework and shared terminology for describing artificial intelligence (AI) systems that use machine learning (ML).

The current system and software process catalogs that 5338’s 2023 abstract names without a year are, on today’s ISO pages:

• ISO/IEC/IEEE 15288:2023, Systems and software engineering — System life cycle processes, edition 2, published 2023-05, 116 pages, from ISO/IEC JTC 1/SC 7. It establishes a common framework of process descriptions for describing the life cycle of systems created by humans. ISO records 2023-05-16 as the publication date. The 2015 edition is listed as Withdrawn.
• ISO/IEC/IEEE 12207:2026, Systems and software engineering — Software life cycle processes, edition 2, published 2026-04, 140 pages, from ISO/IEC JTC 1/SC 7. ISO records 2026-04-29 as the publication date. The 2017 edition is listed as Withdrawn.

5338:2023 names ISO/IEC/IEEE 12207 and ISO/IEC/IEEE 15288 without a year in the public abstract. This article does not claim that 5338 was revised to track 12207:2026. It records the current catalog editions next to a 2023 AI-process standard that points at those families.

How to read 23894 and 5338 together

Neither document is an aviation acceptable means of compliance on any official page we cite. For AI inside a safety-related function, the ISO catalog page to start with is ISO/IEC TR 5469 — a technical report, not these two International Standards. See ISO/IEC TR 5469 and IEC 61508 for ML components.

NIST publishes a crosswalk from the AI RMF to ISO/IEC FDIS 42001. We have not found an official NIST crosswalk to 23894 or 5338 on the pages we cite, so we do not invent one.

Questions

Is ISO/IEC 23894 a certifiable AI management system?

No official ISO page we cite says that. ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS), and ISO says organizations may choose certification. 23894’s public abstract is guidance on managing AI-specific risk.

Does ISO/IEC 5338 replace ISO/IEC/IEEE 12207 or 15288 for the whole product?

The 5338 abstract says the opposite for traditional elements: the software life cycle processes in ISO/IEC/IEEE 12207 and the system life cycle processes in ISO/IEC/IEEE 15288 can be used to implement that element.

Is either document an FAA or EASA means of compliance?

We have not found an official FAA or EASA page that says so. See the FAA AI Safety Assurance Roadmap and EASA AI Concept Paper.