What ISO/IEC 5338 Defines and What It Leaves Open
ISO/IEC 5338:2023 was developed by ISO/IEC JTC 1/SC 42, the joint technical committee responsible for AI standardization, and builds on the lifecycle process structures established in ISO/IEC/IEEE 15288 for systems engineering and ISO/IEC/IEEE 12207 for software engineering. It organizes AI system lifecycle activity into five process groups: agreement processes, organizational project-enabling processes, technical management processes, technical processes, and AI-specific processes. The AI-specific group addresses activities that differ from generic software development, including data handling, AI model development, and verification and validation of AI system behavior. What the standard does not do is prescribe a catalog of organizational roles or a built-in RACI matrix. It specifies process purposes and outcomes, leaving the assignment of accountable, responsible, consulted, and informed parties entirely to the implementing enterprise.
Why the Accountability Gap Emerges in Practice
Because ISO/IEC 5338 is process-based rather than role-based, enterprises adopting it often lack a clear operational framework for translating process outcomes into named accountability. This produces governance gaps at the points where AI systems and agents move from development into runtime operation, precisely where ownership tends to become ambiguous. Reconciling ISO/IEC 5338 with ISO/IEC 42001, the companion SC 42 standard for AI management systems, helps close part of this gap, since 42001 is the more explicit source for top management responsibility and organizational AI governance roles. Enterprises typically also need to reconcile 5338 process ownership with existing IT governance models such as ITIL or DevOps role structures, to avoid duplicate or conflicting sign-off chains across security, platform engineering, and compliance functions.
Constructing a RACI Template Across the Five Process Groups
A workable RACI template starts by treating each of ISO/IEC 5338's five process groups as a unit of accountability, then assigning named roles within the enterprise (rather than generic titles) as responsible, accountable, consulted, or informed for the outcomes of each group.
| Process group | Governance focus |
|---|---|
| Agreement processes | Acquisition and supply arrangements for AI systems and components. |
| Organizational project-enabling | Governance infrastructure, resourcing, and portfolio oversight. |
| Technical management | Planning, risk, configuration, and decision management across the lifecycle. |
| Technical processes | Requirements, architecture, integration, and verification activities. |
| AI-specific processes | Data handling, model development, and AI behavior verification and validation. |
The Runtime Gap: Where the Standard's Process Model Ends
ISO/IEC 5338's operational processes are less granular than its design and development processes, which means the standard offers limited structure for continuous accountability once an AI system is running in production. Runtime AI agent oversight, including autonomous decision-making, tool use, and delegated actions, is not explicitly scoped within the standard's operational process definitions. This leaves a gap between development-oriented RACI assignments, which are typically milestone-based, and the continuous accountability that autonomous agents require once deployed.
Implementation Considerations When Formalizing the RACI Model
Enterprises addressing the runtime gap generally need supplemental controls beyond the RACI template itself:
- Runtime policy enforcement for deployed AI agents
- Ongoing monitoring of agent behavior in production
- Agent identity and permission management aligned to least privilege
- Audit logging that records tool use and delegated actions over time
Where Trussed AI fits
Trussed AI's runtime governance capabilities are built specifically to operate in this space, extending accountability from one-time development checkpoints into continuous oversight of deployed agent behavior.