ISO/IEC 5338 Implementation Checklist for AI Governance
Implementation Checklist

ISO/IEC 5338 Implementation Checklist

ISO/IEC 5338:2023 defines AI system life cycle processes by extending ISO/IEC/IEEE 12207 and 15288 with AI-specific stages covering data acquisition, model development, verification and validation, deployment, operation, and retirement. Implementing it requires mapping existing SDLC and MLOps artifacts to each process group, assigning ownership across engineering and governance functions, and establishing traceable evidence at every stage, from requirements through decommissioning.

Explore Runtime Governance Talk to an Expert

ISO/IEC 5338 Lifecycle at a Glance

The standard's process groups map onto five practical stages that most engineering and governance teams already track in some form.

Life Cycle StageFocus Area
Inception & DevelopmentRequirements, data acquisition, and model development activities
Verification & ValidationAI-specific testing distinct from traditional software V&V
DeploymentRelease approval and production readiness gates
Operation & MaintenanceContinuous monitoring rather than a one-time handoff
RetirementDecommissioning, credential revocation, and audit trail closure

Where Runtime Governance and Agent Controls Fit

Runtime governance concentrates on the later, operational portion of the life cycle, where deployed AI agents interact with production systems.

  1. Deployment

    Agent identity verification and least-privilege configuration before production release.

  2. Operation

    Runtime policy enforcement, tool approval controls, and continuous monitoring.

  3. Retirement

    Credential revocation and audit log closure for decommissioned agents.

What ISO/IEC 5338 Defines

ISO/IEC 5338:2023, published by ISO/IEC JTC 1/SC 42, specifies life cycle processes for AI systems. Rather than replacing existing engineering standards, it extends ISO/IEC/IEEE 12207 (software life cycle processes) and ISO/IEC/IEEE 15288 (systems engineering life cycle processes), layering AI-specific processes on top of the generic process groups those standards already define. The scope runs across the full life cycle: inception, development, deployment, operation, maintenance, and retirement or decommissioning. For governance leaders, the practical implication is that ISO/IEC 5338 is not a standalone framework to build from scratch. Organizations with a mature SDLC or systems engineering process map already have a scaffold to extend, provided they add the AI-specific process elements the standard introduces, such as data acquisition, AI model development, and AI-specific verification and validation.

Process Groups and Enterprise Workflow Mapping

Because ISO/IEC 5338 is built on the 12207/15288 process model, its structure follows familiar categories, including agreement processes, organizational project-enabling processes, technical management processes, and technical processes, with AI-specific processes inserted where AI introduces distinct engineering concerns. In practice this