ISO/IEC 38507:2022 PDF

Overview

ISO/IEC 38507:2022 - Information technology - Governance of IT - Governance implications of the use of artificial intelligence by organizations - provides guidance for members of an organization’s governing body to enable and govern the use of Artificial Intelligence (AI). The standard helps ensure AI is used effectively, efficiently and acceptably across the organization and is applicable to any organization (public, private, government or not‑for‑profit) of any size. It also addresses a broader audience including executive managers, external specialists, policymakers, service providers and auditors.

Key topics and requirements

ISO/IEC 38507:2022 focuses on governance implications rather than technical implementation. Core topics covered include:

• Governance principles and accountability
  • Role of the governing body in setting goals, oversight and remaining accountable for AI use.
• Maintaining governance when introducing AI
  • Ensuring policies, controls and organisational structures adapt to AI adoption.
• AI system characteristics
  • How AI differs from other IT (decision automation, data‑driven problem solving, adaptive systems) and implications for governance.
• AI ecosystem, benefits and constraints
  • High‑level discussion of opportunities and limitations that affect organisational strategy.
• Policies to address AI use
  • Guidance areas: governance oversight, decision‑making, data use, culture and values, compliance and risk.
• Risk and compliance
  • Considerations for risk appetite, risk management, compliance obligations and controls specific to AI use.
• Normative references and terminology
  • Aligns with ISO/IEC 38500 and ISO/IEC 22989 terminology and governance concepts.

Note: the document emphasizes governance (human decision‑making and policy) and references related standards for detailed technical controls, risk management and trustworthiness.

Practical applications and users

ISO/IEC 38507 is practical for:

• Boards and governing bodies establishing strategic direction and oversight for AI initiatives.
• Executive management integrating AI into business strategy, risk and compliance programs.
• Legal, audit and compliance teams assessing obligations and controls for AI deployment.
• IT and data leaders aligning AI projects with organisational governance and data policies.
• Consultants, assessors and policymakers designing frameworks, audits or regulation around AI use.

Typical use cases: setting AI governance frameworks, updating data governance and accountability practices, defining oversight and reporting for automated decision systems, and aligning AI initiatives with organisational ethics and compliance.

Related standards

• ISO/IEC 38500 - Governance of IT for the organization (governance principles)
• ISO/IEC 22989 - AI concepts and terminology (terminology referenced by 38507)

Keywords: ISO/IEC 38507:2022, AI governance, governance of AI, AI risk management, data governance, oversight, accountability, AI policy.