What is the ISO/IEC AI standards family?

How it works

It is a standards architecture, not a single code

The phrase "ISO/IEC AI standards family" is shorthand for a connected set of international standards rather than one closed instrument. The work sits mainly in ISO/IEC JTC 1/SC 42, the joint ISO and IEC committee for AI standardisation. That matters because these documents are standards body instruments, not legislation, not a treaty and not a vendor method.

In other words, the family offers a governance architecture. Organisations can use it directly, buyers can build it into supplier assurance, and regulators can point to parts of it in guidance or technical frameworks. But the standards themselves are still voluntary unless another instrument, such as a contract, procurement rule or regulation, makes their use obligatory in a specific context.

The terminology layer sets the shared language

The family starts with common concepts and terminology. ISO/IEC 22989 exists to establish the vocabulary of AI and describe the field's core concepts. That sounds basic, but it is one of the most important layers in practice. Governance work gets messy when "AI system", "model", "autonomy", "bias", "risk" or "use" mean different things to engineering, compliance, procurement and audit.

A related support document, ISO/IEC 23053, gives a generic framework for describing AI systems that use machine learning. Together, these documents help teams describe what is actually being governed. They give later standards a common base and reduce confusion in policies, due diligence questionnaires, audit criteria and internal reporting.

The management system layer is the organisational anchor

ISO/IEC 42001 is the family member that anchors the organisation's overall AI governance. It is a requirements standard for an artificial intelligence management system, or AIMS. That means it tells an organisation to establish the policies, objectives, roles, processes and review mechanisms needed to manage AI responsibly across the business.

This is a crucial distinction from a model benchmark or a technical test. ISO/IEC 42001 works at organisation level. It is about leadership, accountability, risk management, data governance, transparency information, monitoring and continual improvement. It is the document most likely to become the backbone of board reporting, internal assurance and supplier governance because it asks whether the organisation has a reliable management structure for AI, not just whether one model performed well in a lab.

The risk and impact layer adds operational depth

ISO/IEC 23894 provides guidance on AI related risk management. Its role is to help organisations that develop, produce, deploy or use AI integrate AI specific risk work into their existing governance and operational processes. It is not trying to replace enterprise risk management. It adds AI specific thinking to it.

ISO/IEC 42005 provides guidance for AI system impact assessment. Its focus is different. It asks organisations to examine how an AI system, and its foreseeable applications, may affect individuals, groups or society. In practice, that means impact assessment is the family member most clearly aimed at documenting human, social and broader societal effects of a particular system over time.

These two standards are complementary, not interchangeable. Risk management asks what hazards, failures, uncertainties or control weaknesses must be managed. Impact assessment asks who may be affected, in what ways, under what conditions, and what governance follow up is needed. Good AI governance usually needs both lenses.

The conformity layer turns governance into assurance

ISO's own drafting rules matter here. Documents that contain requirements can be used for conformity assessment. Documents that are guidance only are not intended to be used that way. That is why ISO/IEC 42001 occupies a different position from ISO/IEC 23894 and ISO/IEC 42005. The latter two are important support standards, but they are not the main badge an organisation seeks to certify against.

ISO/IEC 42006 sits on top of ISO/IEC 42001 and provides the additional requirements for bodies that audit and certify AI management systems. It builds on ISO/IEC 17021-1 and is also relevant to accreditation bodies assessing those certifiers. This is the start of a recognisable conformity infrastructure for AI management systems: an organisation implements an AIMS, an external certification body audits it, and an accreditation body may assess whether that certifier is competent to do so.

That still does not create a universal public approval mark for every AI product. It creates a structured way to assess an organisation's management system for AI. ISO/IEC 42006 also signals a wider direction of travel because it can be integrated into broader conformity assessment schemes for AI products, processes or services, but the family's published assurance architecture is strongest at the management system level.

The family supports regulation without replacing law

The legal status is straightforward. ISO states that its international standards are voluntary and do not displace national law. National law takes precedence. So the ISO/IEC AI standards family does not create statutory duties by itself, and there is no single global enforcement authority for it.

Its regulatory value is different. The family gives organisations a disciplined way to create evidence: defined terms, governance policies, role assignments, risk records, impact assessment records, internal audits, management reviews and, if chosen, third party certificates. That evidence can support procurement, supplier reviews, supervisory discussions and internal accountability. But none of it should be confused with automatic legal compliance. Domestic AI, privacy, sector and consumer rules still have to be mapped and met on their own terms.