ISO/IEC 5338 Roles and Responsibilities: Who Owns Each Process

What ISO/IEC 5338 Actually Defines

ISO/IEC 5338:2023, developed by ISO/IEC JTC 1/SC 42, defines AI system life cycle processes by adapting the ISO/IEC/IEEE 15288 systems and software engineering life cycle framework for AI-specific use. Rather than introducing a novel structure, it follows the 15288 pattern of agreement processes, organizational project-enabling processes, technical management processes, and technical processes, with AI-specific additions layered in. Life cycle activities are organized across stages including inception, development, verification and validation, deployment, operation and monitoring, and retirement.

Critically, the standard specifies process purpose and outcome statements rather than job titles or organizational roles. This means two enterprises can both claim ISO/IEC 5338 conformance while assigning ownership of the same process to entirely different internal functions. The standard tells an organization what must happen at each stage; it does not tell the organization who inside the enterprise is accountable for making it happen.

Mapping Process Groups to Typical Enterprise Ownership

ISO/IEC 5338 organizes its life cycle activities into five process groups. Before assigning internal ownership, it helps to have a clear view of what each group covers, summarized below.

How to Assign Ownership in Practice

Because the standard defines outcomes rather than named roles, closing the ownership gap is a deliberate internal exercise. The following steps outline a practical approach.

1. Run a RACI-style mapping exercise against each 5338 process group, since the standard defines outcomes rather than named roles.
2. Assign operation and monitoring ownership as a distinct function, separate from pre-deployment data science and engineering roles.
3. Extend monitoring ownership definitions explicitly to cover autonomous or agentic decision-making, not just model performance metrics.
4. Pair 5338 process ownership with ISO/IEC 42001 accountability requirements to produce audit-ready documentation.
5. Review ownership assignments at each life cycle stage transition, since responsibility often shifts without formal handoff.
6. Confirm governance functions have visibility into runtime behavior, not only pre-deployment sign-off.

The Runtime and Agentic Ownership Gap

ISO/IEC 5338 treats operation and monitoring as a distinct life cycle stage, which is a meaningful structural acknowledgment that AI systems require attention after deployment. However, the standard does not prescribe specific runtime control mechanisms, particularly for autonomous or agentic systems that make decisions or take actions without continuous human review.

This creates a practical gap: the same technical team that owns model development and validation is often assumed to own runtime behavior by default, even though monitoring drift, intervening in autonomous decision-making, and enforcing runtime policy require different tooling, different escalation paths, and often a different accountable function. Emerging frameworks address this gap more explicitly than the base 5338 text. NIST's Generative AI Profile (NIST AI 600-1, July 2024) specifically addresses risks associated with increasingly autonomous systems that earlier lifecycle guidance did not fully cover. For enterprises deploying AI agents, this suggests runtime operation and monitoring should be treated as its own ownership category, not an extension of development-phase responsibility.

Pairing ISO/IEC 5338 with ISO/IEC 42001 and NIST AI RMF

ISO/IEC 5338 is a process-definition standard, not a certifiable management system. ISO/IEC 42001:2023 fills that gap as a certifiable AI management system standard that requires organizations to formally define roles, responsibilities, and top management accountability for AI-related functions. Pairing the two gives enterprises both the process detail of 5338 and the documented accountability structure that auditors and certification bodies expect.

NIST's AI Risk Management Framework (AI RMF 1.0) adds a complementary lens through its four core functions, Govern, Map, Measure, and Manage, which apply directly to ongoing risk management of systems already in production. None of these three sources alone provides complete coverage of runtime and agentic accountability. Ownership for autonomous AI behavior currently sits at the intersection of all three, which means enterprises relying on any single standard in isolation are likely to leave gaps at that intersection.

Where Runtime Governance Fits

For enterprises operating AI agents, the operation and monitoring gap identified above is where runtime governance and security functions become relevant. Trussed AI provides runtime governance and security for enterprise AI agents, including runtime policy enforcement, runtime monitoring, agent identity and permissions, least privilege controls, tool approval workflows, and audit logging.

These capabilities address the specific ownership category that ISO/IEC 5338 acknowledges as a distinct life cycle stage but does not define controls for: what happens to an AI system, particularly an autonomous one, after it is deployed. This is not a substitute for the organizational role-mapping work described above, but it is the technical layer that makes runtime ownership enforceable once a role has been assigned.

Frequently Asked Questions