Wiki · Concept · Last reviewed July 10, 2026

ISO/IEC 5338

ISO/IEC 5338 is the ISO/IEC International Standard for AI system life cycle processes.

Category: AI lifecycle / standards Published: July 10, 2026 Modified: July 10, 2026 Last reviewed: July 10, 2026 Tags: ISO, IEC, AI lifecycle, systems engineering, AI governance, assurance

Definition

ISO/IEC 5338:2023 is titled Information technology — Artificial intelligence — AI system life cycle processes. ISO lists it as Edition 1, a 39-page International Standard published in December 2023, with reference number ISO/IEC 5338:2023.

The public ISO abstract says the standard defines processes and associated concepts for describing the life cycle of AI systems based on machine learning and heuristic systems. It is based on ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207, with AI-specific modifications and additions from ISO/IEC 22989 and ISO/IEC 23053.

Status

As reviewed on July 10, 2026, ISO lists ISO/IEC 5338:2023 as published, with publication stage 60.60. Its lifecycle record shows new-project approval on August 19, 2020, committee-draft registration on December 6, 2021, close of the committee-draft comment period on March 11, 2022, DIS ballot initiation on October 13, 2022, close of voting on January 6, 2023, final text received on June 14, 2023, proof activity in September and November 2023, and publication on December 20, 2023.

ISO identifies ISO/IEC JTC 1/SC 42 as the responsible technical committee and classifies the standard under ICS 35.020. The SC 42 committee page describes the subcommittee's scope as standardization in artificial intelligence and lists working groups for foundational standards, data, trustworthiness, use cases and applications, and computational approaches.

Lifecycle Surface

ISO/IEC 5338 matters because AI systems do not fit comfortably inside a one-time software release model. Training data, model behavior, evaluation results, monitoring signals, operating context, and human use all change the shape of the system over time. A life cycle standard gives teams a way to describe the work as recurring processes rather than a single build step.

The ISO abstract says the standard provides processes that support definition, control, management, execution, and improvement of the AI system across life cycle stages. That language is useful for governance because it ties AI-specific work to ordinary system and software engineering discipline without pretending that machine-learning systems are just conventional software modules.

Engineering Use

For builders, ISO/IEC 5338 is most useful when the team has to coordinate AI work across engineering, procurement, product, risk, security, data governance, and operations. It can help distinguish the process that defines a system from the process that controls it, the process that executes development work from the process that manages improvement, and the process that handles an AI-specific component from the process that handles a traditional software or system element.

The ISO abstract says traditional software elements can use ISO/IEC/IEEE 12207 and traditional system elements can use ISO/IEC/IEEE 15288. That boundary matters in mixed systems. A fraud system, content-moderation workflow, cyber defense assistant, or agentic operations tool may include trained models, rules, user interfaces, logs, authorization controls, APIs, and human review procedures. The life cycle record should show which process governs each part.

Evidence Record

An ISO/IEC 5338-informed record should identify the AI system, system boundary, life cycle stage, responsible process, owner, input artifact, output artifact, decision gate, validation or verification method, monitoring signal, change trigger, and retirement or disposal consideration. It should also say when an AI-specific process hands off to a conventional software or systems process.

The record should be maintained after deployment. AI systems can change through data refreshes, model updates, prompt changes, policy changes, tool integrations, user adaptation, and external environment shifts. A life cycle process that ends at launch is not enough for systems whose risk profile can change while they remain in use.

Boundary With Other Standards

ISO/IEC 5338 is not itself an AI management-system standard, risk-management guide, impact-assessment guide, or data-quality standard. It should be read beside standards that cover those adjacent surfaces. ISO/IEC 42001 addresses AI management systems, ISO/IEC 23894 addresses AI risk management, ISO/IEC 42005 addresses AI impact assessment, and ISO/IEC 5259 addresses data quality for analytics and machine learning.

Source Discipline

Use the official ISO page for the title, reference number, International Standard status, publication date, stage, edition, page count, technical committee, ICS classification, public abstract, and lifecycle dates. Use the ISO/IEC JTC 1/SC 42 page for committee scope and working-group structure. Do not cite vendor summaries for the standard's formal status, and do not treat ISO/IEC 5338 as a certification mark, product approval, or legal safe harbor.

Spiralist Reading

Spiralism reads ISO/IEC 5338 as a discipline against launch theater. AI products are often narrated as a dramatic release: a model ships, a feature appears, a dashboard goes live. The life cycle view is colder and more useful. It asks what process created the system, what process controls it, what process monitors it, what process improves it, and what process ends it.

That framing is especially important for agents and automated decision environments. The ethical question is not only whether a model was trained well. It is whether the organization can show how the system is acquired, changed, observed, corrected, and retired. A lifecycle record turns governance from a promise into a sequence of accountable handoffs.

Open Questions

Sources

Return to Wiki