ISO/IEC 5338 Gap Assessment: 30-Day Guide

Implementation Guide

ISO/IEC 5338 Gap Assessment for AI Systems

An ISO/IEC 5338 gap assessment is a structured, time-bound review that maps existing AI governance documentation and runtime technical controls, including agent identity, permission scoping, and audit logging, against the lifecycle process requirements defined in ISO/IEC 5338. A focused 30-day version inventories AI systems, maps controls to lifecycle stages, validates findings with engineering and risk teams, and produces a prioritized remediation roadmap.

Talk to an Expert Explore Runtime Governance

Mapping Runtime Controls to Lifecycle Processes

  1. Agent identity and authentication

    Documented as evidence supporting technical processes governing AI system operation and monitoring.

  2. Least-privilege permission scoping

    Supports evidence for utilization and support process controls addressing operational risk.

  3. Tool-call logging and auditability

    Provides evidence relevant to verification, validation, and ongoing monitoring processes.

  4. Runtime policy enforcement points

    Guardrails and policy engines should be traceable to organizational risk management processes referenced in ISO/IEC 5338 and ISO/IEC 23894.

  5. Centralized control inventory

    Absence of a centralized inventory of runtime controls across AI systems is a common architectural gap surfaced during lifecycle-based assessments.

What ISO/IEC 5338 Defines

Why the Gap Surfaces Late

A 30-Day Assessment Sequence

30-day assessment schedule by week
WeekFocusWhat Happens
Week 1Inventory and BaselineInventory AI systems in use, identify the life cycle stage of each, and catalog existing governance documentation against ISO/IEC 5338 process categories.
Week 2Control MappingMap existing technical controls, including identity, access, monitoring, and logging, to specific lifecycle processes to surface documentation and control gaps.
Week 3ValidationValidate findings through interviews and evidence review with engineering, security, and risk teams to confirm control maturity claims.
Week 4Prioritization and RoadmapPrioritize identified gaps by risk and produce a remediation roadmap with named owners and target timelines.

Evaluation Criteria for a Defensible Assessment

  • Confirm the methodology maps explicitly to ISO/IEC 5338 process categories rather than a generic AI governance checklist.
  • Verify that agent identity and permission data can be traced to specific lifecycle process evidence.
  • Separate documentation and policy gaps from runtime enforcement gaps in the final report.
  • Cross-reference findings with ISO/IEC 42001 and NIST AI RMF to avoid duplicative remediation work across overlapping requirements.
  • Assign a named process owner for each lifecycle stage to support audit defensibility.

Frequently Asked Questions

How does ISO/IEC 5338 relate to ISO/IEC 42001?

ISO/IEC 5338 defines AI system life cycle processes, while ISO/IEC 42001 establishes requirements for an AI management system that governs AI development and use. The two are complementary: 42001 provides organizational accountability structures, while 5338 provides the underlying process framework across the life cycle. Assessments often consolidate evidence collection across both standards.