Wiki · Concept · Last reviewed June 25, 2026

ISO/IEC 23053

ISO/IEC 23053:2022 is an international framework standard for describing artificial intelligence systems that use machine learning, including their components, functions, and place in the broader AI ecosystem.

Category: AI governance Published: June 25, 2026 Modified: June 25, 2026 Last reviewed: June 25, 2026 Tags: ISO, IEC, machine learning, AI governance, standards

Definition

ISO/IEC 23053:2022, Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML), is an International Standard from ISO and IEC. ISO lists it as Edition 1, published in June 2022, with ISO/IEC JTC 1/SC 42 as the responsible technical committee. The ISO page marks the standard as published and identifies it as a 36-page document.

The standard gives a conceptual framework and shared terminology for describing AI systems that use machine learning. ISO's public summary says it defines components and functions of ML-based AI systems inside the broader AI ecosystem, with the aim of helping both technical experts and non-specialists describe these systems in a structured and consistent way.

Scope

ISO/IEC 23053 is a description standard, not a certification badge, risk score, safety case, or legal permission slip. Its value is that it gives teams a common system map before they argue about risk, impact, procurement, or assurance. If a buyer, auditor, regulator, engineer, and product owner use different words for the model, data pipeline, human interface, monitoring process, or deployment environment, the governance conversation is already unstable.

ISO says the standard is intended for organizations of any size or sector that design, develop, deploy, or evaluate AI systems using machine learning. It also says deep learning is covered because deep learning is a subset of machine learning. That makes the entry relevant to contemporary generative-AI systems, but it does not turn a framework document into proof that a specific model or agent is trustworthy.

Relationship to Other Standards

ISO/IEC 23053 sits between terminology and governance. ISO/IEC 22989 establishes AI terminology and concepts. ISO/IEC 23053 uses that kind of shared vocabulary to describe ML-based AI systems. ISO/IEC 23894 then gives AI risk-management guidance, ISO/IEC 42001 specifies an artificial intelligence management system, ISO/IEC 42005 gives AI system impact-assessment guidance, and ISO/IEC 42006 addresses bodies that audit and certify AI management systems.

That sequence matters. A serious organization should not jump from "we use AI" to "we have governed AI" without first describing the system. The descriptive layer names what exists: data sources, ML components, operating context, interfaces, humans in the loop, deployment boundaries, and evaluation hooks. The governance layer decides what to do about those things.

Governance and Safety

The strongest use of ISO/IEC 23053 is system inventory discipline. A model-mediated service is rarely just a model. It may include training data, evaluation data, feature pipelines, prompts, retrieval indexes, ranking logic, model routers, monitoring dashboards, human escalation, access controls, third-party APIs, logs, and post-deployment update paths. A shared framework pushes the organization to identify the whole AI system rather than governing the visible chatbot or score alone.

For agents, the need is sharper. An ML component may sit inside a workflow that can read files, call tools, spend money, send messages, or write to institutional records. ISO/IEC 23053 does not solve agent authorization or prompt injection. It helps identify the components and functions that later controls must govern. The standard becomes useful when it forces the question: which part of the system made the decision, which part took the action, and which part preserves evidence?

Evidence Record

An ISO/IEC 23053-informed system description should identify the AI system boundary, ML components, data sources, model-development path, evaluation setup, deployment context, human roles, external services, monitoring signals, update process, and retirement or rollback conditions. For high-impact deployments, it should also distinguish the model artifact from the surrounding product, operator workflow, user interface, and organizational policy.

The practical test is reconstructability. If a system fails, a reviewer should be able to trace what was in the AI system, what was outside it, what evidence existed before deployment, and which assumptions connected the technical components to the human process.

Source Discipline

Use the official ISO page for the title, reference number, publication month, edition, committee, status, page count, public summary, and ISO's description of scope. Use ISO/IEC 22989 for terminology claims, ISO/IEC 23894 for AI risk-management claims, ISO/IEC 42001 for AI management-system claims, and ISO/IEC 42005 for impact-assessment claims. Do not cite ISO/IEC 23053 as evidence that a deployed AI system is safe; cite it as a framework for describing what the system is.

Spiralist Reading

ISO/IEC 23053 is a map ritual. Before an institution can govern the machine, it has to say where the machine is. The danger is not only that AI systems are opaque. It is that organizations routinely misname them: calling a workflow a model, a vendor integration a feature, a monitoring gap a launch issue, or an agent action a user action.

Spiralism reads the standard as a check against that drift. A named system can still be dangerous, unfair, brittle, or unnecessary. But an unnamed system cannot be seriously audited. The first governance act is drawing the boundary clearly enough that responsibility has somewhere to land.

Open Questions

Sources

Return to Wiki