Two Standards, Two Governance Layers
ISO/IEC 5338 and ISO/IEC 5339 are both published by ISO/IEC JTC 1/SC 42 as part of the broader family of AI standards, but they address different questions. ISO/IEC 5338 governs how an AI system moves through its life cycle: acquisition, development, verification, deployment, operation, and eventual retirement. ISO/IEC 5339 governs what the system is for, providing a structured way to describe and analyze AI use cases and the application areas in which they operate. Neither standard is a substitute for the other, and most enterprise governance programs need to reference both.
How ISO/IEC 5338 Applies to Enterprise AI Systems
ISO/IEC 5338 defines the life cycle process framework an organization applies to an AI system from acquisition through retirement. It gives engineering, MLOps, and risk teams a consistent set of process checkpoints for developing, verifying, deploying, and operating AI systems, and for decommissioning them when they reach end of life. Ownership of these life cycle processes typically sits with the teams responsible for building and running the system rather than the teams that requested it.
How ISO/IEC 5339 Applies to Use Case Documentation
ISO/IEC 5339 provides guidance for describing and analyzing AI use cases and application areas. This documentation typically sits with business or product owners, since it captures the intended purpose of an AI system and the context in which it is meant to operate. On its own, a use case description is not a life cycle control; it is an input that should inform the requirements and verification work carried out under a life cycle standard such as ISO/IEC 5338.
What Neither Standard Covers
Neither ISO/IEC 5338 nor ISO/IEC 5339 defines runtime technical controls. Neither standard specifies how an organization should establish agent identity, authorize individual tool calls, or produce audit logs for AI system behavior in production. These standards operate at the process and documentation layer of AI governance; closing the gap to runtime enforcement requires a dedicated governance layer built for that purpose.
Aligning ISO/IEC 5338 and 5339 in a Governance Program
Organizations that already work with process standards such as ISO/IEC/IEEE 12207 or 15288, or with SC 42 standards such as ISO/IEC 42001 or ISO/IEC 23894, generally get the most value from 5338 and 5339 by extending existing structures rather than building new, AI-only ones. A few practical alignment points:
- Assign clear ownership: use case description under 5339 typically sits with business or product owners; life cycle process governance under 5338 typically sits with engineering, MLOps, or risk teams.
- Treat use cases as inputs, not endpoints: 5339 use case records should feed into 5338 requirements and verification processes rather than exist as a separate documentation exercise.
- Extend existing process documentation: if your organization already aligns to ISO/IEC/IEEE 12207 or 15288, extend that documentation for AI-specific considerations rather than building a parallel AI-only process set.
- Integrate with existing change management: map 5338 life cycle checkpoints to existing change management and release approval steps instead of creating a separate AI-specific approval track.
- Cross-reference related SC 42 standards: where a program already references ISO/IEC 42001 or ISO/IEC 23894, explicitly cross-link those requirements with 5338 and 5339 to avoid duplicated controls.
Where process documentation ends
5338 and 5339 tell you how an AI system should move through its life cycle and what it is meant to do. They do not tell you how to enforce agent identity, tool-call permissions, or audit logging once that system is running in production. That is the layer runtime governance controls are built to address.