What it covers. Published in 2023, this is the first international management system standard for artificial intelligence. It sets requirements for establishing, maintaining and improving an AI management system for organisations that develop, provide or use AI systems, with an annex of controls and guidance on responsible AI.
In practice. Organisations define the scope of AI use, assign accountability, assess AI risks and impacts on individuals and society, and apply controls across the AI system life cycle, including data quality, transparency and human oversight. It follows the same management system structure as ISO/IEC 27001, so it can be integrated with an existing ISMS. It is often used to support preparation for obligations such as the EU AI Act. Auditors expect an AI inventory, impact assessments and evidence of monitoring.
Common gaps. Common gaps are an incomplete inventory of AI use, including shadow tools, and impact assessments done once and never updated.