Guidance for governing-body oversight of AI so that authority, expected benefits, risk reporting and accountability are visible in decisions.
Scope and use
ISO/IEC 38507:2022 describes governance implications when an organization uses AI. It supports oversight and decision-making; it is not a technical test specification or a stand-alone certifiable management-system standard.
Key requirements
- Inventory AI use and assign decision rights for approval, acceptable use, exceptions and continued operation.
- Ask management to consider intended outcomes, affected stakeholders, data, model limitations, legal duties and risk appetite before approval.
Implementation outline
- Inventory AI use and assign decision rights for approval, acceptable use, exceptions and continued operation.
- Ask management to consider intended outcomes, affected stakeholders, data, model limitations, legal duties and risk appetite before approval.
- Require proportionate monitoring and reporting of performance, incidents, material changes and unresolved risks to the responsible governance body.
- Set governance principles; identify accountable roles; connect AI use to strategy and risk management; review reports and outcomes; update decisions when conditions change.