ISO/IEC 5338 and the AI System Life Cycle
ISO/IEC 5338:2023, formally titled "Information technology, Artificial intelligence, AI system life cycle processes," was published by ISO/IEC JTC 1/SC 42 to define a structured set of processes covering the full life cycle of AI systems, from acquisition and development through operation, maintenance, and retirement. Rather than creating an entirely new process model, the standard adapts and extends life cycle process groups already established in ISO/IEC/IEEE 12207, which covers software life cycle processes, and ISO/IEC/IEEE 15288, which covers systems engineering life cycle processes. It adds AI-specific processes where AI systems introduce characteristics that general software or systems engineering models do not fully address.
The standard organizes its processes into groups, including agreement processes, organizational project-enabling processes, technical management processes, and technical processes. Operation and Monitoring is one of the AI-specific technical processes within this structure, positioned in the life cycle after deployment and functioning alongside related processes such as continued validation and re-evaluation. ISO/IEC 5338 is written to apply broadly, to any organization involved in AI system engineering activities including acquisition, supply, development, operation, maintenance, or retirement, regardless of organization size, sector, or the AI system's application domain.
What the Operation and Monitoring Process Addresses
At a scope level, the Operation and Monitoring process is concerned with what happens to an AI system after it moves from development and validation into active use. This distinguishes it from earlier life cycle processes focused on design, verification, and pre-deployment validation, which establish whether a system meets requirements before release. Operation and Monitoring instead addresses the ongoing question of whether a deployed AI system continues to behave as expected once it is exposed to live data, real users, and evolving operating conditions.
Life cycle process standards derived from ISO/IEC/IEEE 15288 and 12207 typically define each process through a purpose statement, a set of expected outcomes, and associated activities and tasks that produce those outcomes. ISO/IEC 5338 follows this same structural convention across its process definitions. Organizations designing a conformance program should review the published clause text directly, since the specific enumerated activities, inputs, and outcomes for Operation and Monitoring are defined in the standard itself and are not reproduced here. What can be stated with confidence is the process's position and intent: it establishes a mechanism for ongoing oversight that feeds observations back into other life cycle processes, rather than operating as an isolated monitoring function disconnected from governance decisions.
Governance Considerations Before Claiming Conformance
Organizations ev