ISO/IEC 22989:2022
ISO/IEC's foundational AI standard, built as the concepts an organisation applies rather than a glossary: data processes and dataset separation, retraining and continuous learning, the eight trustworthiness characteristics, verification and validation, jurisdictional and societal risk, the stakeholder roles, every life cycle stage from inception to retirement, and human oversight from prediction to action.
ISO/IEC 22989:2022 is a compliance framework from International with 5 domains and 28 controls. The largest domains are Clause 6: AI system life cycle stages and their processes – ISO/IEC 22989:2022 (11 controls), Clauses 5.15 to 5.18: Trustworthiness characteristics, verification and validation, jurisdiction and societal impact – ISO/IEC 22989:2022 (11 controls), Clauses 5.10 and 5.11: Data and machine learning concepts an organisation applies – ISO/IEC 22989:2022 (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Clause 5.19: AI stakeholder roles – ISO/IEC 22989:2022
| Code | Title |
|---|---|
| iso-iec-22989-2022::5.19 | Identify the AI stakeholder roles the organisation and others hold |
Clause 6: AI system life cycle stages and their processes – ISO/IEC 22989:2022
| Code | Title |
|---|---|
| iso-iec-22989-2022::6.1 | Adopt a life cycle model that carries governance, privacy, security and transparency throughout |
| iso-iec-22989-2022::6.2.2a | Inception: set objectives and life-cycle-wide requirements |
| iso-iec-22989-2022::6.2.2b | Inception: assess AI risk, identify harms, benefits and values, and plan treatment |
| iso-iec-22989-2022::6.2.2c | Inception: record for transparency and accountability, and secure cost, funding and resources |
| iso-iec-22989-2022::6.2.3 | Design and development: approach, architecture, code, training data and risk treatment |
| iso-iec-22989-2022::6.2.4 | Verification and validation: test with separate representative data, accept, review risk |
| iso-iec-22989-2022::6.2.5 | Deployment: target environment and risk treatment review |
| iso-iec-22989-2022::6.2.6 | Operation and monitoring: monitor, repair, update, support and review risk |
| iso-iec-22989-2022::6.2.7 | Continuous validation where the system keeps learning |
| iso-iec-22989-2022::6.2.8 | Re-evaluation: assess results against objectives and refine them |
| iso-iec-22989-2022::6.2.9 | Retirement: decommission and discard, or replace |
Clauses 5.10 and 5.11: Data and machine learning concepts an organisation applies – ISO/IEC 22989:2022
| Code | Title |
|---|---|
| iso-iec-22989-2022::5.10 | Run the data processes an AI system depends on |
| iso-iec-22989-2022::5.11.6-5.11.8 | Keep training, validation and test data separate and representative |
| iso-iec-22989-2022::5.11.9 | Retrain for data drift and concept drift, and govern continuous learning |
Clauses 5.15 to 5.18: Trustworthiness characteristics, verification and validation, jurisdiction and societal impact – ISO/IEC 22989:2022
| Code | Title |
|---|---|
| iso-iec-22989-2022::5.15.2 | Establish AI robustness: performance held under atypical conditions |
| iso-iec-22989-2022::5.15.3 | Establish AI reliability over the operation stage |
| iso-iec-22989-2022::5.15.4 | Establish AI resilience and fault tolerance with recovery |
| iso-iec-22989-2022::5.15.5 | Provide controllability: who can intervene in which component |
| iso-iec-22989-2022::5.15.6 | Provide explainability of the factors behind decisions |
| iso-iec-22989-2022::5.15.7 | Define predictability with objective criteria |
| iso-iec-22989-2022::5.15.8 | Provide transparency to stakeholders about the system and its data |
| iso-iec-22989-2022::5.15.9 | Detect and treat unwanted bias to avoid unfairness |
| iso-iec-22989-2022::5.16 | Decide what can be verified and what must be validated |
| iso-iec-22989-2022::5.17 | Plan for legal requirements that differ between jurisdictions |
| iso-iec-22989-2022::5.18 | Assess the level of societal risk of the system |
Clauses 7.1 and 7.4: Human oversight and the path from prediction to action – ISO/IEC 22989:2022
| Code | Title |
|---|---|
| iso-iec-22989-2022::7.1 | Provide human design choices, engineering and oversight throughout |
| iso-iec-22989-2022::7.4 | Understand that outputs are error prone and set thresholds for automated decisions |
What is ISO/IEC 22989:2022 and who does it apply to?
ISO/IEC 22989:2022 is a compliance framework from International with 5 domains and 28 controls. ISO/IEC's foundational AI standard, built as the concepts an organisation applies rather than a glossary: data processes and dataset separation, retraining and continuous learning, the eight trustworthiness characteristics, verification and validation, jurisdictional and societal risk, the stakeholder roles, every life cycle stage from inception to retirement, and human oversight from prediction to action. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ISO/IEC 22989:2022 actually require?
ISO/IEC 22989:2022 has 28 controls organised across 5 domains. The largest domains are Clause 6: AI system life cycle stages and their processes – ISO/IEC 22989:2022 (11 controls), Clauses 5.15 to 5.18: Trustworthiness characteristics, verification and validation, jurisdiction and societal impact – ISO/IEC 22989:2022 (11 controls), Clauses 5.10 and 5.11: Data and machine learning concepts an organisation applies – ISO/IEC 22989:2022 (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ISO/IEC 22989:2022 do I already cover?
ISO/IEC 22989:2022 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement ISO/IEC 22989:2022?
Start your ISO/IEC 22989:2022 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO/IEC 22989:2022 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required