Is ISO/IEC 5338 Mandatory? Common Misunderstandings About AI Lifecycle Standards

What ISO/IEC 5338 is, and what status it has

ISO/IEC 5338:2023 is catalogued by ISO/IEC JTC 1/SC 42 as "Information technology — Artificial intelligence — AI system life cycle processes". Its subject is the set of processes an organization applies across the life of an AI system. It is a standard published by standards bodies. It is not a statute, a regulation or an agency rule, and a reader should not expect it to carry legal force on its own.

A standard becomes binding only if a law or contract points to it. Compliance leaders should therefore ask a narrow question: does a law or contract in a jurisdiction where we operate require this standard by name? Confusion usually starts when a standard is mentioned in guidance, a draft or a vendor questionnaire, and the mention is read as an obligation. A reference to a standard is not a legal incorporation of it.

The practical consequence is that ISO/IEC 5338 can be a useful internal reference for how lifecycle work is organized, while the obligations you must meet come from the laws and contracts that apply to you.

Five misunderstandings and their practical implications

Misunderstanding 1: "ISO/IEC 5338 is a legal requirement." The legal instrument in this space is the EU AI Act, Regulation (EU) 2024/1689. ISO/IEC 5338 is a separate standard. Implication: record it in your policy set as a voluntary reference, not in your register of legal obligations, unless counsel identifies a specific legal or contractual hook.

Misunderstanding 2: "We need to certify against it." Do not assume a certification path exists, and do not tell customers or auditors that you are certified to ISO/IEC 5338. Implication: if you have mapped your lifecycle practices to the standard, describe it as a mapping or an internal reference and keep the wording factual.

Misunderstanding 3: "It is the same as ISO/IEC 42001 or ISO/IEC 22989." They are distinct. ISO/IEC 22989 is a concepts and terminology standard. ISO/IEC 42001 is positioned as a management system standard, which addresses how an organization manages AI as a whole, while 5338 addresses lifecycle processes for AI systems. Implication: avoid one combined "ISO AI program". Scope each reference separately so the program is not over-built.

Misunderstanding 4: "Following it satisfies the EU AI Act or the NIST AI RMF." Do not state that following ISO/IEC 5338 satisfies AI Act obligations. The AI Act and the NIST AI RMF are separate instruments, one a law and one voluntary, and evidence mapped to them should rest on each instrument's own text. Implication: keep a mapping table per instrument rather than a single claim of conformity.

Misunderstanding 5: "The AI Act timeline is settled around the standards." The Commission states that delayed availability of standards put the 2 August 2026 high-risk date in jeopardy. The Digital Omnibus on AI entered into force on 27 July 2026. As of November 2026, the high-risk dates are 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded in products. Implication: update internal plans that still cite 2 August 2026, and re-check the timeline periodically, since the Act can also be amended by delegated and implementing acts.

Keeping adjacent instruments separate in policy documents

The table summarizes how each instrument should be described. Keeping these distinctions in your policy language prevents wrongly assumed legal obligations and over-scoped programs.

• ISO/IEC 5338:2023: International standard on AI system life cycle processes. Not a law. Cite it by its catalogue designation and do not describe it as a certification.
• ISO/IEC 22989: Separate standard for AI concepts and terminology. Useful for shared vocabulary, not for lifecycle process requirements.
• ISO/IEC 42001: Management system standard for AI. Distinct from the lifecycle process standard. Scope it separately.
• EU AI Act: Regulation (EU) 2024/1689. In force. As of November 2026, high-risk dates are 2 December 2027 and 2 August 2028.
• NIST AI RMF: Voluntary resource. NIST materials mention ISO/IEC 5338 among related standards, which is a reference, not a legal incorporation.

Which lifecycle activities depend on runtime controls and durable evidence

Lifecycle process guidance describes what an organization should do at each stage. It does not by itself produce the records an auditor can examine. For stages such as operation and monitoring, the difference matters. A policy that is written down and reviewed after the fact tells an auditor what you intended. It does not show what the system was allowed to do, or did, on a given interaction.

Accountability is increasingly framed around reliable evidence for external stakeholders. The 2023 NTIA request for comment, for example, focused on measures that give such evidence that AI systems are legal, effective, ethical, safe and otherwise trustworthy. That is policy context, not a requirement specific to ISO/IEC 5338, but it describes the expectation a regulated enterprise will meet in audit conversations.

This is the one area where Trussed is relevant. Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants: allow, redact, block, rate limit, or escalate for human approval. The scope is individual interactions and tool calls. Because policy is enforced at runtime, not reviewed after the fact, enforcement itself generates continuous audit-ready evidence, mapped to frameworks including the EU AI Act and NIST. In production, this has run continuously for 18+ months in a regulated enterprise, with 100+ models under one policy plane.

The boundary is worth stating plainly. Runtime enforcement covers what happens on interactions and tool calls once a system is operating. It does not replace the other lifecycle activities your adopted reference describes, and it does not provide model lineage or end-to-end tracing of agentic workflows. Those activities need their own records and owners.