ISO/IEC 38507:2022 Governance implications of the use of AI by organizations

What it is

ISO/IEC 38507:2022, Information technology, Governance of IT, Governance implications of the use of artificial intelligence by organizations, was published in April 2022. It sits in the ISO/IEC 38500 family on the governance of IT, developed under JTC 1/SC 40, the committee for IT service management and IT governance.

It is written for the people who govern an organisation rather than those who manage it day to day. Its central question is what additional opportunities, risks and responsibilities the use of AI brings, and how the governing body should respond. It deliberately stays above the technology, focusing on the organisation’s use of AI rather than how AI systems are built. The standard is paid.

Who it applies to

The primary audience is members of the governing body, such as directors, trustees and council members. It is also useful for executive managers who implement the board’s direction, and for advisers such as lawyers, auditors and risk specialists who support the board.

It applies to organisations of any size, whatever their dependence on data or information technology, in the public, private and not-for-profit sectors. “Use” is read broadly to cover developing or applying an AI system at any stage of its lifecycle, including relationships with any party that provides or uses such systems. It is voluntary unless a policy or contract requires it.

What it requires

As guidance it recommends rather than mandates. Its themes are the following.

Maintaining governance and accountability

The governing body remains accountable for the organisation’s use of AI, including decisions made or supported by AI systems. Using AI does not transfer that accountability to the technology, the vendor or the people who built it. The board should make sure accountability is assigned clearly inside the organisation and that the governance of AI fits within existing structures, such as IT governance, risk governance and information security governance.

Understanding AI’s opportunities and risks

Directors should understand enough about AI to oversee it. That means recognising how AI differs from other technology, such as its reliance on data, its potential for opaque or unexpected behaviour, its ability to change over time and its capacity to act at speed and scale. The board weighs these against the value AI can create.

Setting direction through policy

The governing body should set the organisation’s intent for AI through policy, including the acceptable uses of AI, the organisation’s risk appetite for AI, and the ethical and legal constraints it will operate within. Policy should cover data use, compliance with law, and the culture and values the organisation expects AI use to reflect.

Oversight and monitoring

The board should require reporting that lets it monitor AI use against its policies and risk appetite. That includes knowing which AI systems are in use, the risks they carry and the controls in place, being told about incidents and significant changes, and reviewing whether governance arrangements remain effective as AI use grows.

Applying the ISO/IEC 38500 model

The standard applies the 38500 principles and the evaluate, direct and monitor model to AI. The governing body evaluates current and future AI use, directs the preparation and implementation of plans and policies, and monitors performance and conformance.

Key dates

ISO/IEC 38507 was published in April 2022 as its first edition and is current.

The Queensland Government’s AI governance policy in Australia requires in-scope departments and statutory bodies to establish AI governance arrangements in line with the current version of ISO/IEC 38507, consistent with their existing governance structures. It is one of the first public mandates of the standard.

How it relates to other frameworks

ISO/IEC 38507 is the board layer of a stack. ISO/IEC 42001 sets requirements for the management system that executives use to carry out the board’s direction, and ISO/IEC 23894 and ISO/IEC 42005 give guidance on the risk and impact assessments inside that system. An organisation can use 38507 to frame what its board asks for and 42001 to show it is being delivered.

Its emphasis on accountability, transparency and human responsibility matches the OECD AI Principles and the governance functions of the NIST AI Risk Management Framework. For boards facing regulation such as the EU AI Act, it provides a way to set direction and oversight that the organisation’s compliance work can report into.