ISO/IEC 38507 vs ISO/IEC 42001: Board Governance vs AI Management System

What each standard is

ISO/IEC 38507:2022 is titled "Information technology — Governance of IT — Governance implications of the use of artificial intelligence by organizations." ISO describes it as guidance for members of an organization's governing body to enable and govern the use of AI, so that use within the organization is effective, efficient and acceptable. Its reader is the board or equivalent body, and it is framed as guidance rather than as a specification for a management system.

ISO/IEC 42001:2023 is titled "Information technology — Artificial intelligence — Management system." It is the international standard for AI management systems and gives requirements and guidance for organizations that develop, provide or use AI systems. It defines how to establish, implement, maintain and continually improve an AI management system, and it applies to organizations of all sizes and sectors. ISO describes it as built around a Plan-Do-Check-Act process that covers risk assessment through the treatment of those risks.

Certification to ISO/IEC 42001 is voluntary. An organization may choose it to obtain independent confirmation that its AI management system meets the requirements of ISO/IEC 42001:2023.

Side-by-side comparison

The two documents differ in audience and in the kind of obligation they express. The table compares them on the dimensions that matter most when assigning accountability.

• Purpose: 38507: enable and govern AI use so that it is effective, efficient and acceptable. 42001: establish, implement, maintain and continually improve an AI management system.
• Intended audience: 38507: members of the governing body. 42001: organizations that develop, provide or use AI systems, and the management that operates the system.
• Nature of document: 38507: governance guidance. 42001: requirements standard for a management system.
• Certification: 38507: positioned as guidance for the governing body. 42001: voluntary certification for independent confirmation that the management system meets its requirements.
• Method: 38507: governing-body direction and oversight of AI use. 42001: Plan-Do-Check-Act cycle covering risk assessment through risk treatment.
• Related documents: 42001 is complemented by ISO/IEC 42005 on AI impact assessment. As of November 2026, ISO/IEC 42003, implementation guidance for 42001, is still under development.

Where responsibility sits: governing body and management

The high-level split is clear. The governing body sets direction and oversees AI use. Management establishes, implements, maintains and improves the management system that gives that direction effect. A practical reading is that the board decides what AI use is acceptable and how much risk is tolerable, while management turns those decisions into policies, procedures, assigned roles, risk assessments, risk treatments and monitoring.

Two failure modes follow from treating the standards as interchangeable. In the first, the board approves a policy statement but no defined path carries it into controls, so intent never reaches the systems it is meant to constrain. In the second, management pursues certification and assumes board accountability is therefore met. Certification speaks only to whether the management system meets 42001 requirements. It does not substitute for governing body oversight.

ISO describes 42001 and 42005 together as linking high-level organizational oversight to system-level evaluation. Impact assessment is a required, consistent part of the management system, and 42005 aims to make those assessments thorough, systematic and actionable. The board-facing layer and the system-facing layer need a defined interface between them, and reporting is that interface.

The gap between documented policy and running AI

A management system produces documents: policies, risk assessments, procedures, records of review. Those show that an organization decided what should happen. An auditor or board member will eventually ask a different question: what did the AI systems actually do, and how do you know the policy was applied at that moment?

The gap is usually architectural. If policy is enforced only through training, review cycles or after-the-fact sampling, the organization cannot show that a given interaction or tool call complied. If policy is enforced in the execution path, each request can be allowed, redacted, blocked or escalated for human approval before it takes effect, and each decision can be recorded with the rule that drove it. That record is operational evidence. It supports the monitoring a management system requires and gives the governing body reporting based on observed behavior rather than on attestations.

This is the layer where Trussed operates. Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants, at the level of individual interactions and tool calls. Enforcement generates audit-ready evidence, mapped to frameworks including HIPAA, NAIC, NYDFS, the EU AI Act and NIST. Trussed is runtime enforcement and evidence. It is not a certification or a governance program, and using it does not confer ISO conformance.

Using the two standards together

Start with the governing body's direction: which AI uses are acceptable, who is accountable, and what the board expects to see reported. Use the Plan-Do-Check-Act structure of 42001 to organize how that direction becomes policy, risk assessment, risk treatment and monitoring. Treat impact assessment as part of that system from the beginning, with 42005 as support for doing it well.

Decide explicitly whether you need certification or want to align with 42001 without certifying. Certification is voluntary, and the answer depends on whether independent confirmation matters to your customers, regulators or board. Either way, define in advance what evidence each control must produce, so that the record exists when it is asked for.

Track ISO/IEC 42003 as under development as of November 2026, and do not rely on it as published guidance. In the meantime, the discipline that matters is stable: a named accountable body, a management system that translates its direction into controls, and runtime enforcement that leaves evidence of what the AI was allowed to do and what it did.