What ISO/IEC 5338 Defines
ISO/IEC 5338:2023, titled Information technology, Artificial intelligence, AI system life cycle processes, was published by ISO/IEC JTC 1/SC 42, the joint technical committee responsible for AI standardization. It defines a process reference model for managing AI systems from concept through retirement, building directly on the established systems and software engineering lifecycle models in ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207. Rather than introducing an entirely new AI-native lifecycle taxonomy, ISO/IEC 5338 extends these existing models with AI-specific considerations.
The standard is scoped broadly: it applies to any organization involved in acquiring, supplying, developing, operating, or maintaining AI systems, regardless of size or industry. Like the standards it builds on, ISO/IEC 5338 follows a process-reference-model approach, meaning it defines the purpose and expected outcomes of each lifecycle process without prescribing specific tools, architectures, or technical implementation methods. This makes it a framework for organizing engineering work rather than a checklist to be completed once.
Lifecycle Stages and Process Groups
ISO/IEC 5338 structures AI system lifecycles into stages that mirror standard systems engineering practice: concept, development, production, utilization, support, and retirement. Work within these stages is organized into process groups consistent with the structure used in ISO/IEC/IEEE 15288, including agreement processes, organizational project-enabling processes, technical management processes, and technical processes.
Agreement processes cover acquisition and supply relationships when AI components or services are sourced externally. Organizational processes establish the infrastructure, resourcing, and project-level accountability that enable development work to proceed. Technical management processes coordinate planning, risk tracking, and configuration activities across the lifecycle. Technical processes are the engineering activities that actually build, verify, and validate the AI system. For governance leaders, this structure is useful less as a taxonomy to memorize and more as a way to separate what is being engineered from who is accountable for enabling and managing that engineering work.
Agreement Processes
Govern acquisition and supply relationships for AI system components and services.
Organizational Processes
Establish enabling infrastructure and project-level accountability for AI development work.
Technical Management Processes
Coordinate planning, risk, and configuration activities across the AI system lifecycle.
Technical Processes
Cover the engineering activities that build, verify, and validate the AI system itself.
System-Level vs Organizational-Level Accountability
One of the more practical contributions of ISO/IEC 5338 is its separation of system-level technical processes from organizational-level enabling processes. In many enterprises, engineering teams and governance or risk functions operate with unclear boundaries: it is often unclear whether a given control or decision belongs to the people building the model or the people responsible for organizational risk posture.
By explicitly distinguishing technical processes from organizational and agreement processes, ISO/IEC 5338 gives enterprises a starting point for assigning named ownership to each process group. This does not resolve every accountability question on its own, but it provides a shared vocabulary that governance and engineering teams can use when defining who signs off on what, and at which stage of the lifecycle that sign-off occurs.
Where the Standard Stops: The Runtime Governance Gap
ISO/IEC 5338 is a process reference model, not a runtime control standard. It does not define technical controls for monitoring deployed AI systems, overseeing autonomous agent behavior, detecting drift in production, or enforcing least-privilege access to tools and data once a system is operating live. This is not a defect in the standard; process-reference models are not designed to specify runtime instrumentation.
But it does mean that an organization aligned with ISO/IEC 5338 has documented who is responsible for building, verifying, and managing an AI system through its lifecycle stages, without necessarily having any mechanism to enforce policy, monitor behavior, or control tool access once that system or an agent built on it is deployed. Closing that gap requires operational capabilities such as runtime policy enforcement, agent identity and permission management, tool approval workflows, and audit logging. Trussed AI provides governance and security controls specifically for this runtime layer, covering AI agent oversight, MCP security, and agent-to-agent security once systems move from development into production use. This is a distinct and complementary layer to the process discipline that ISO/IEC 5338 establishes, not a substitute for it.
ISO/IEC 5338 vs ISO/IEC 42001
ISO/IEC 5338 and ISO/IEC 42001 address different layers of AI governance and are not interchangeable. ISO/IEC 5338 defines the lifecycle process