What ISO/IEC 5338 Covers
ISO/IEC 5338, titled "Information technology, Artificial intelligence: AI system life cycle processes," is an international standard developed under ISO/IEC JTC 1/SC 42, the joint technical committee responsible for AI standardization. SC 42 also maintains related standards covering AI trustworthiness, risk management, and governance, so 5338 is best understood as part of a broader standards portfolio rather than a standalone document.
For AI platform engineering teams, the practical value of the standard is structural. It gives life cycle governance a shared vocabulary and a defined set of stages against which internal practices can be measured and compared across teams. Any checklist built against 5338, including this one, should be treated as a starting point for gap analysis. Teams implementing the standard for compliance purposes should work from the full published text rather than a summarized checklist alone.
The Life Cycle Structure AI Teams Need to Govern
AI system life cycle standards generally organize governance around a sequence of stages that mirror established software and systems engineering practice: inception and requirements definition, development, verification and validation, deployment, operation and monitoring, and eventual retirement. Each stage typically has its own expected inputs, such as documented requirements or test results, and its own expected outputs, such as release records or monitoring logs.
For AI systems specifically, this structure carries added weight because model behavior, permissions, and risk profile can change after deployment in ways that traditional software does not. A checklist aligned to this structure needs to account for both the pre-deployment engineering work and the ongoing operational controls that keep a system's behavior consistent with what was originally validated.
Where Enterprise Practice Typically Falls Short
Most gaps in AI life cycle governance do not appear at the design or development stage, where teams tend to already produce documentation as part of normal engineering process. They appear once a system reaches production. Development records exist, but there is often no equivalent, ongoing record of how the system behaves, what permissions it holds, or how those permissions have changed over time.
A second common gap is ownership. Requirements and validation are usually owned by engineering, while operational risk and compliance are often owned by separate functions. Without a shared record that both sides can reference, life cycle governance breaks down exactly at the handoff between development and operation, which is also the point where an AI system's real-world behavior first diverges from what was originally tested.
Runtime Governance and the Operational Stage
The operational and maintenance portion of the AI system life cycle is where most unmanaged risk accumulates, because it is the stage with the least standardized tooling across the industry. Runtime governance addresses this gap by giving teams a continuous, auditable record of how a system or agent behaves in production, rather than relying solely on pre-deployment testing.
Trussed AI provides runtime governance and security capabilities relevant to this stage, including agent identity, least-privilege permissions, tool approval workflows, runtime policy enforcement, and audit logging. These capabilities do not replace the documentation and process work required earlier in the life cycle, but they give operational and maintenance stages the same kind of traceable record that development and verification stages typically already have.