ISO/IEC 5338:2023

INTERNATIONAL ISO/IEC
STANDARD 5338
First edition
2023-12
Information technology — Artificial
intelligence — AI system life cycle
processes
Technologies de l'information — Intelligence artificielle — Processus
de cycle de vie des systèmes d'IA
Reference number
© ISO/IEC 2023
© ISO/IEC 2023
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
© ISO/IEC 2023 – All rights reserved

Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 2
5 Key concepts . 2
5.1 General . 2
5.2 AI system concepts . 4
5.3 AI system life cycle model . 4
5.4 Process concepts . 7
5.4.1 Criteria for processes . 7
5.4.2 Description of processes . 7
5.4.3 Conformance . 8
6 AI System life cycle processes .8
6.1 Agreement processes . 8
6.1.1 Acquisition process . 8
6.1.2 Supply process . 8
6.2 Organizational project-enabling processes . 9
6.2.1 Life cycle model management process . 9
6.2.2 Infrastructure management process . 9
6.2.3 Portfolio management process . 9
6.2.4 Human resource management process . 10
6.2.5 Quality management process . 10
6.2.6 Knowledge management process . 11
6.3 Technical management processes . 11
6.3.1 Project planning process . . 11
6.3.2 Project assessment and control process .12
6.3.3 Decision management process. 13
6.3.4 Risk management process . 13
6.3.5 Configuration management process . 15
6.3.6 Information management process . 16
6.3.7 Measurement process . 16
6.3.8 Quality assurance process . 16
6.4 Technical processes . . 17
6.4.1 Business or mission analysis process . 17
6.4.2 Stakeholder needs and requirements definition process . 18
6.4.3 System requirements definition process. 19
6.4.4 System architecture definition process . 20
6.4.5 Design definition process . 20
6.4.6 System analysis process . 20
6.4.7 Knowledge acquisition process . 20
6.4.8 AI data engineering process . 21
6.4.9 Implementation process . 24
6.4.10 Integration process . 26
6.4.11 Verification process . 26
6.4.12 Transition process . 27
6.4.13 Validation process .28
6.4.14 Continuous validation process .29
6.4.15 Operation process .30
6.4.16 Maintenance process . 31
6.4.17 Disposal process . 33
iii
© ISO/IEC 2023 – All rights reserved

Annex A (informative) Observations based on use cases in ISO/IEC TR 24030 .34
Bibliography .38
iv
© ISO/IEC 2023 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance
are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria
needed for the different types of document should be noted. This document was drafted in
accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or
www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of
any claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC
had not received notice of (a) patent(s) which may be required to implement this document. However,
implementers are cautioned that this may not represent the latest information, which may be obtained
from the patent database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall
not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see
www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 42, Artificial intelligence.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
v
© ISO/IEC 2023 – All rights reserved

Introduction
Artificial intelligence (AI) systems in the fields of computer vision and image recognition, natural
language processing, fraud detection, automated vehicles, predictive maintenance and planning have
achieved remarkable successes. To build and maintain an AI system, it is an efficient approach to extend
the life cycle processes for a traditional software system to include AI-specific life cycle characteristics.
An example of such a specific characteristic of an AI system life cycle is where a system employs
machine learning (ML) using training data and it becomes necessary to retrain the ML model using new
training data that is more representative of current production data.
ISO/IEC/IEEE 12207 describes software life cycle processes and ISO/IEC/IEEE 15288 describes system
life cycle processes. While these life cycle processes are broadly applicable to AI systems, they require
the introduction of new processes and the modification of existing processes to accommodate the
characteristics of AI systems. This document extends the current generic life cycle process International
Standards to make them applicable for AI systems so that the AI system life cycle can benefit from
established models and existing practices. Some AI systems are in use in areas which are related to
safety, such as health care or traffic control. Such safety critical AI systems need special attention and
[5]
considerations as described in ISO/IEC TR 5469 .
Integrating the AI system life cycle into existing processes delivers efficiency gains, better adoption
of AI and mutual understanding among AI system stakeholders as defined in ISO/IEC 22989. Such an
integrated life cycle approach embraces the fact that AI systems typically are a combination of AI-
specific elements and traditional elements such as source code and databases.
This document provides further details on AI system life cycle processes as discussed in
[18]
ISO/IEC 42001 .
vi
© ISO/IEC 2023 – All rights reserved

INTERNATIONAL STANDARD ISO/IEC 5338:2023(E)
Information technology — Artificial intelligence — AI
system life cycle processes
1 Scope
This document defines a set of processes and associated concepts for describing the life cycle of AI
systems based on machine learning and heuristic systems. It is based on ISO/IEC/IEEE 15288 and
ISO/IEC/IEEE 12207 with modifications and additions of AI-specific processes from ISO/IEC 22989 and
ISO/IEC 23053.
This document provides processes that support the definition, control, management, execution and
improvement of the AI system in its life cycle stages. These processes can also be used within an
organization or a project when developing or acquiring AI systems. When an element of an AI system
is traditional software or a traditional system, the software life cycle processes in ISO/IEC/IEEE 12207
and the system life cycle processes in ISO/IEC/IEEE 15288 can be used to implement that element.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC/IEEE 15288:2023, Systems and software engineering — System life cycle processes
ISO/IEC/IEEE 12207:2017, Systems and software engineering — Software life cycle processes
ISO/IEC 22989:2022, Information technology — Artificial intelligence — Artificial intelligence concepts
and terminology
ISO/IEC 23053, Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML)
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 22989, ISO/IEC 23053,
ISO/IEC/IEEE 15288, ISO/IEC/IEEE 12207 and the following apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
knowledge acquisition
process of locating, collecting, and refining knowledge and converting it into a form that can be further
processed by a knowledge-based system
Note 1 to entry: Knowledge acquisition normally implies the intervention of a knowledge engineer, but it is also
an important component of machine learning.
[SOURCE: ISO/IEC 2382:2015, 2123777, modified — Notes 2 to entry 3 to entry have been deleted.]
© ISO/IEC 2023 – All rights reserved

4 Abbreviated terms
AI artificial intelligence
ML machine learning
5 Key concepts
5.1 General
AI system life cycle consists of three types of processes:
— Generic processes: Processes that are identical to the processes defined in ISO/IEC/IEEE 15288 and
ISO/IEC/IEEE 12207.
— Modified processes: Processes where elements are modified, added or removed from the
ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207 definition.
NOTE 1 The Clause for each of these “Modified processes” contains a subclause of AI-specific particularities
that provide guidance to adapt the process to AI systems.
— AI-specific processes: Processes that are specific to characteristics of AI systems but are not based
directly on any processes in ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207.
AI system life cycle processes in Clause 6 are presented as generic, modified or AI-specific. Figure 1
shows the life cycle processes of AI system, grouped by type, and compared to ISO/IEC/IEEE 15288:2023,
Figure 4.
© ISO/IEC 2023 – All rights reserved

Figure 1 — AI system life cycle processes relative to ISO/IEC/IEEE 15288:2023, Figure 4
The following aspects of AI systems are key factors that differentiate the life cycle processes from those
that are traditional systems:
— Measurable potential decay: Since AI models aim to model a desired behaviour which can change
over time, measuring and monitoring any deviations of the production data (data drift) or deviations
towards the desired output (concept drift) can be required. The changing of desired behaviour is
not restricted to AI systems only, but for AI models this is uniquely measurable by validating input
and output.
— Potentially autonomous: AI system’s ability to make automated, complex and fast decisions creates
the potential to replace actions or processes otherwise executed by humans. Consequently,
AI systems can require extra attention to ensure fairness, security, safety, privacy, reliability,
transparency and explainability, accountability, availability, integrity and maintainability. The
more likely an AI system is able to do harm, the more important this extra attention becomes.
[14]
See ISO/IEC TR 24368 for an overview of ethical and societal concerns in the development and
[11]
deployment of AI systems. See ISO/IEC 23894 for more information of risk management of AI
systems.
— Iterative requirements and behaviour specification: AI systems can be based on iterative and agile
requirements specification, knowledge specification, behaviour modelling and usability design.
AI system development can take place through cycles of requirements specification, prototype
demonstration and requirements refinement. This aspect differs from traditional software
applications based on fixed, well-defined requirements. Further, as AI systems are used, the
© ISO/IEC 2023 – All rights reserved

requirements can also evolve as unseen situations arise and refined requirements, specifications
and gaps are identified.
— Probabilistic: Decisions made by AI systems based on machine learning are inherently probabilistic.
Therefore, it is important for stakeholders to recognize that decisions made by AI systems are not
always correct. Formally testing the correctness of models has inherent limitations and uncertainties
when it comes to guarantees.
— Reliant on data: AI systems based on machine learning rely on sufficient, representative data to
train, test and validate models. The behaviour of machine learning models is not programmed but is
instead learned from the data. Because of this, it is important that particular consideration be given
to the data (e.g. data quality) that are required for an AI system for training, testing, verification and
validation.
— Knowledge intensive: For heuristic models, knowledge acquisition is of relatively high importance,
since the knowledge is coded explicitly in the model and determines its correctness.
— Novel: New knowledge and skills can be required for organizations designing, developing or using
AI systems. Other stakeholders, such as AI system users, can be unfamiliar with AI. This can cause
trust and adoption challenges. The novelty of AI can cause overconfidence and enthusiasm without
fully accounting for AI system risks. The perception that AI systems can eventually replace humans
or demonstrate intelligence can also impact how stakeholders view AI systems.
— Incomprehensible: In case of heuristic models or machine learning, model behaviour is emergent
in the sense that it is not explicitly programmed but is instead the indirect result of knowledge
engineering or derived from the training data. Stakeholders can find AI systems to be less predictable,
explainable, transparent, robust and understandable than explicitly programmed systems. This can
reduce trust in AI systems.
[14]
NOTE 2 A high-level overview of AI ethical and societal concerns can be found in ISO/IEC TR 24368. More
[20]
information on addressing ethical concerns during system design can be found in IEEE 7000-2021 .
5.2 AI system concepts
A model can be a machine learning model which has learned how to compute based on data, or it can be
a heuristic model engineered based on human knowledge. In a heuristic model, the computations are
engineered explicitly (procedural), implicitly by specifying rules or probabilities (declarative), or both.
In the case of machine learning, the data are the primary input for the model. For a heuristic model, the
primary input is knowledge. Regardless, both data and knowledge are required in either case. Data are
needed to test heuristic models and to perform analysis to build the knowledge. Knowledge is required
to understand the context in which a machine learning model operates and to help select and prepare
data for training and testing.
For traditional systems, both knowledge and data are often important as well. Knowledge can be
required to implement business logic. Data typically plays an important part in any data processing
system and can be required for functional testing.
[3]
The differentiation between an AI system and an AI application is provided in ISO/IEC 5339 . The
[3]
distinguishing characteristics of AI applications are also defined in ISO/IEC 5339 .
5.3 AI system life cycle model
The AI system life cycle model describes the evolution of an AI system from inception through
retirement. This document does not prescribe a specific life cycle. Instead, it concentrates on AI-specific
processes that can occur during the system life cycle. AI-specific processes can occur during one or
more of the life cycle stages and individual stages of the life cycle can be repeated during the system’s
existence. For example, during the re-evaluation stage development and deployment can be repeated
multiple times to implement bug fixes and system updates.
© ISO/IEC 2023 – All rights reserved

A system life cycle model helps stakeholders build AI systems more effectively and efficiently.
International Standards are useful in developing the life cycle model, including ISO/IEC/IEEE 15288
[10]
for systems as a whole, ISO/IEC/IEEE 12207 for software and ISO/IEC/IEEE 15289 for system
documentation. These International Standards describe life cycle processes for traditional systems.
Figure 2 is based on ISO/IEC 22989:2022, Figure 3. It provides an example of the stages and high-
level processes that can be applied to the development and life cycle of AI systems. For details, see
ISO/IEC 22989:2022, 6.1.
The AI system life cycle or any subset of its stages can be owned and managed by separate organizations
or entities (e.g. acquisition and provision of data, ML model or the code for other components used
for the AI system development or deployment). Additionally, an organization can depend on other
organizations to establish the infrastructure or to provide the necessary capability of the AI system
life cycle (e.g. infrastructure setup cutting across on-premise, cloud-based or hybrid). This document
takes into account the implications, specifics and associated risks of the AI system supply chain to
propose new processes, adapt and tailor existing processes to build an AI system across organizational
boundaries.
In addition, certain domains have specific life cycle International Standards such as medical devices,
[19]
where IEC 62304:2006+A1: 2015 applies. Organizations should consider the AI specifics described
[19]
in this document together with IEC 62304:2006+A1: 2015 when implementing such domain specific
standards.
Figure 2 — Example of AI system life cycle model stages and high-level processes
The stages in Figure 3 are based on the stages described in ISO/IEC 22989 together with grouping of
technical processes described in this document. The stage “continuous validation” is not marked as
“in case of continuous learning”, in contrast with the example life cycle model in ISO/IEC 22989:2022,
Figure 4. The continuous validation stage is also applicable in situations without continuous learning,
for example, to detect data drift, concept drift or to detect any technical malfunctions.
© ISO/IEC 2023 – All rights reserved

Figure 3 — AI system life cycle stages with technical processes
The concept of stages is meant to group activities that have a certain chronological order, to illustrate
their dependency, but it does not suggest complete separation of activities in time or in the organization.
For example, in agile software development, development and operation are distinct stages which are
performed concurrently. Nevertheless, a piece of functionality first should be implemented before it
can be verified and then deployed.
© ISO/IEC 2023 – All rights reserved

Furthermore, the sequence of stages can take place counter to the direction of arrows, for example
when after the verification and validation stage it is decided to perform some activities as part of the
design and development stage again.
NOTE 1 Stages in the life cycle in Figure 3 can have entry and exit criteria based on the specific requirements
[15]
of the system in question (see ISO/IEC/IEEE 24748-1 ).
An AI model can be either a machine learning model or a heuristic model.
The key technical processes for developing ML models are integrated into the life cycle processes as
follows:
— system requirements definition process: set model requirements;
— AI data engineering process: acquire and update data;
— AI data engineering process: prepare data;
— implementation process and maintenance process: (re)train and tune model;
— verification process: test model before deployment;
— transition process: deploy model;
— continuous validation process: test model after deployment.
For heuristic models, the key steps are integrated as follows:
— system requirements definition process: set model requirements;
— knowledge acquisition process: acquire knowledge;
— implementation process and maintenance process: create and update model;
— verification process: test model before deployment;
— transition process : deploy model.
NOTE 2 The final decision whether to develop an AI system or a traditional system is the result of the inception
stage, where requirements, risks, business and stakeholder needs are taken into account.
Annex A provides an analysis of the results of applying the traditional system life cycle processes to the
[13]
use cases of AI systems from ISO/IEC TR 24030 .
5.4 Process concepts
5.4.1 Criteria for processes
The life cycle processes in this document are based on the same principles of ISO/IEC/IEEE 15288
and ISO/IEC/IEEE 12207. The processes in this document exhibit a strong relationship between their
outcomes, activities and tasks. In addition, their description minimizes dependencies amongst the
processes and ensures that a process can be executed by a single organization or across multiple
organizations. This is particularly critical as AI systems can be developed across or require capability
or support from a supply chain of organizations.
5.4.2 Description of processes
The purpose describes the goal of the process and is unchanged if the named process is from
ISO/IEC/IEEE 15288 or ISO/IEC/IEEE 12207. The outcome describes the result of the successful
implementation of the process. The activities and tasks describe the implements of the process in
accordance with applicable organization policies and procedures. The AI-specific particularities for
© ISO/IEC 2023 – All rights reserved

processes from ISO/IEC/IEEE 15288 or ISO/IEC/IEEE 12207 are described in the subclause called “AI-
specific particularities”.
5.4.3 Conformance
Conformance with this document is defined as implementing all of the processes, activities and
tasks identified in this document. If a process, activity or a task is not relevant to an AI system, the
absence of that process, activity or task shall be justified and documented. The requirements in
ISO/IEC/IEEE 15288:2023, 4.2 and 4.3 and ISO/IEC/IEEE 12207:2017, 4.2 and 4.3 shall also apply.
6 AI System life cycle processes
6.1 Agreement processes
6.1.1 Acquisition process
6.1.1.1 Purpose
The purpose of the acquisition process is to obtain a product or service in accordance with the acquirer's
requirements.
NOTE The acquirer refers to the stakeholder's role "AI customer" and the supplier refers to "AI producer"
and "AI provider" as defined in ISO/IEC 22989.
6.1.1.2 Outcomes, activities and tasks
The outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.1.1 and
ISO/IEC/IEEE 12207:2017, 6.1.1 shall apply.
6.1.1.3 AI-specific particularities
The acquisition process described in ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207 should be extended
beyond the acquisition of products or services to include the possible acquisition of data for the AI data
engineering process (see 6.4.8). This new kind of acquisition activity can introduce new acquisition
issues such as costs, dependencies, continuity, availability and issues with data rights, rules and
legal requirements regarding the use of the acquired data. For example, contracting and acceptance
of training data is an important issue because contracting and acceptance of datasets is very difficult
to formalize. In addition, the acceptance activities can be followed by iterations of development or
retraining activities in parallel of operations in order to make the accepted dataset remaining in line
with the operational and business requirements.
6.1.2 Supply process
6.1.2.1 Purpose
The purpose of the supply process is to provide an acquirer with a product or service that meets agreed
requirements in the agreement.
NOTE The acquirer refers to the stakeholder's role "AI customer" and the supplier refers to "AI producer"
and "AI provider" as described in ISO/IEC 22989.
6.1.2.2 Outcomes, activities and tasks
The outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.1.2 and
ISO/IEC/IEEE 12207:2017, 6.1.2 shall apply.
© ISO/IEC 2023 – All rights reserved

6.1.2.3 AI-specific particularities
There are no additional activities or tasks defined in the supply process. When implementing the
activities and tasks in 6.1.2.2, the supplier should consider the following AI-specific particularities to
propose, negotiate and agree with the acquirer of the AI system.
— conduct of proof-of-concept to initiate AI system development before deployment;
— provision, collection or acquisition of sufficient datasets for machine learning;
— monitoring or intervention of AI system during the operation in case its performance varies
depending on machine learning production data;
— analysis and improvement of the AI system to address any deviations from required performance.
6.2 Organizational project-enabling processes
6.2.1 Life cycle model management process
The purpose, outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.2.1 and
ISO/IEC/IEEE 12207:2017, 6.2.1 shall apply.
NOTE A typical life cycle model of AI systems is described in 5.3.
6.2.2 Infrastructure management process
The purpose, outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.2.2 and
ISO/IEC/IEEE 12207:2017, 6.2.2 shall apply.
6.2.3 Portfolio management process
6.2.3.1 Purpose
The purpose of the portfolio management process is to initiate and sustain necessary, sufficient and
suitable projects in order to meet the strategic objectives of the organization. This process commits the
investment of adequate organization funding and resources and sanctions the authorities needed to
establish selected projects. Continued assessments are performed in this process to confirm that they
justify, or can be redirected to justify, continued investment.
6.2.3.2 Outcomes, activities and tasks
The outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.2.3 and
ISO/IEC/IEEE 12207:2017, 6.2.3 shall apply.
6.2.3.3 AI-specific particularities
There are no additional activities or tasks defined in the portfolio management process. When
implementing the activities and tasks in 6.2.3.2, organizations should consider the following AI-specific
particularities:
— In the definition and authorization of projects, AI can provide a potential new capability or business
opportunity to innovate through a new project.
— In the identification and allocation of resources to new projects, take into account that AI requires
specific expertise (see 6.2.4).
— Especially when AI is a new capability in an organization, it can be beneficial to identify any multi-
project aspects, so a typical approach can be achieved through the reuse of common AI system
elements or platforms and the exchange of knowledge between projects.
© ISO/IEC 2023 – All rights reserved

— When evaluating projects in the portfolio, specific AI risks should be taken into account (see 6.3.4),
as well as AI-specific aspects regarding project planning. For example, experimentation can require
long periods for training of acceptable ML models.
6.2.4 Human resource management process
6.2.4.1 Purpose
The purpose of the human resource management process is to provide the organization with necessary
human resources and to maintain their competencies, consistent with business needs.
This process provides a supply of skilled and experienced personnel qualified to perform life cycle
processes to achieve organization, project and stakeholder objectives.
6.2.4.2 Outcomes, activities and tasks
The outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.2.4 and
ISO/IEC/IEEE 12207:2017, 6.2.4 shall apply.
6.2.4.3 AI-specific particularities
There are no additional activities or tasks defined in the human resource management process.
The use of AI techniques brings new AI stakeholder roles into the life cycle. For example, data scientists,
data engineers play additional roles as AI developers in machine learning. Knowledge engineers play an
additional role as AI developers in knowledge engineering. When implementing the activities and tasks
in 6.2.4.2, organizations should consider the skills of these additional roles.
Additionally, organizations new to AI should review existing human resources and determine the
appropriateness of their competencies.
See ISO/IEC 22989:2022, 5.17 for more details of AI stakeholder roles (e.g. AI developers, AI providers,
data providers).
6.2.5 Quality management process
6.2.5.1 Purpose
The purpose of the quality management process is to ensure that products, services and implementations
meet both relevant organizational and project quality objectives as well as meeting relevant customer
requirements.
6.2.5.2 Outcomes, activities and tasks
The outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.2.5 and
ISO/IEC/IEEE 12207:2017, 6.2.5 shall apply.
6.2.5.3 AI-specific particularities
There are no additional activities or tasks defined in the quality management process. When
implementing the activities and tasks in 6.2.5.2, organizations should consider the following AI-specific
particularities.
Organizations should consider implementation of the AI-specific particularities laid down in their
quality management processes, including but not limited to their policies, objectives and procedures.
Quality assurance as part of the quality management process and the evaluation thereof can take a
more prominent role in organizations developing, deploying and monitoring AI systems.
© ISO/IEC 2023 – All rights reserved

The continuous quality management activities support the systematic assessment of the performance
of an AI system throughout its life cycle, including its continued quality once it has been deployed.
6.2.6 Knowledge management process
6.2.6.1 Purpose
The purpose of the knowledge management process is to create the capabilities and assets that enable
the organization to exploit opportunities to reapply existing knowledge.
This encompasses knowledge, skills and knowledge assets, including system elements.
The knowledge that is used to create the AI models is discussed in 6.4.7 and 6.4.9.
6.2.6.2 Outcomes, activities and tasks
The outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.2.6 and
ISO/IEC/IEEE 12207:2017, 6.2.6 shall apply.
6.2.6.3 AI-specific particularities
There are no additional activities or tasks defined in the knowledge management process. When
implementing the activities and tasks in 6.2.6.2, organizations should consider the following AI-specific
particularities:
— Elements of an AI system (e.g. datasets, data preparation scripts) should be considered for knowledge
management, just like any other system element.
— Experimentation is an important aspect in the implementation of an AI system. Documenting
experiments is important to prevent having to repeat previous experiments in the future; either by the
same stakeholder or by another stakeholder. Furthermore, artefacts documenting experimentation
provides important insights and lessons learned that can be used for further improvement.
— See 6.2.4 for more details of the human resource regarding data science expertise.
— See 6.4.8 for more details of data lineage and data provenance.
6.3 Technical management processes
6.3.1 Project planning process
6.3.1.1 Purpose
The purpose of the project planning process is to produce and coordinate effective and workable plans.
This process:
— determines the scope of the project management and technical activities;
— identifies process outputs, tasks and deliverables;
— establishes schedules for conducting tasks, including achievement criteria;
— estimates the required resources to accomplish tasks.
This is an ongoing process that continues throughout a project, with regular revisions to plans.
© ISO/IEC 2023 – All rights reserved

6.3.1.2 Outcomes, activities and tasks
The outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.3.1 and
ISO/IEC/IEEE 12207:2017, 6.3.1 shall apply.
6.3.1.3 AI-specific particularities
There are no additional activities or tasks defined in the project planning process. When implementing
the activities and tasks in 6.3.1.2, either projects or organizations, or both should consider the following
AI-specific particularities.
In implementing the activity “plan project and technical management”, it is important to allow
some flexibility with regards to model creation (see ISO/IEC/IEEE 15288:2023, 6.3.1.3 and
ISO/IEC/IEEE 12207:2017, 6.3.1.3). Predictability of software development is already challenging and
for model creation, this is even more the case. Creating a model can require AI data engineering, such
as data gathering, data labelling and data pre-processing (see 6.4.8). For a machine learning-based AI
system, creating a model can require iterations of experiments and experimentation with different
strategies and tactics to achieve the desired model performance and qualities. For a knowledge
engineering-based AI system, creating a model can involve knowledge acquisition and elicitation
efforts.
Furthermore, project planning should take into account the various other AI particularities of the
processes involved, such as establishing continuous validation (see 6.4.14).
6.3.2 Project assessment and control process
6.3.2.1 Purpose
The purpose of the project assessment and control process is:
— to assess if the plans are aligned and feasible;
— to determine the status of the project, technical and process performance;
— to direct execution to help ensure that: the performance is according to plans and schedules, within
projected budgets and satisfies technical objectives.
This process periodically and at major events evaluates the project’s progress and achievements against
requirements, plans and the overall business objectives. Information is provided for management to
act upon when significant variances are detected. This process can include redirecting the project
activities and tasks to correct deviations and variations from other technical management or technical
processes. Redirection can include replanning as appropriate.
6.3.2.2 Outcomes, activities and tasks
The outcomes, activities and tasks provided in ISO/IEC/IEEE 15288:2023, 6.3.2 and
ISO/IEC/IEEE 12207:2017, 6.3.2 shall apply.
6.3.2.3 AI-specific particularities
There are no additional activities or tasks defined in the project assessment and control process.
When implementing the activities and tasks in 6.3.2.2, either projects or organizations, or both should
consider the following AI-specific particularities.
In implementing the activity “plan for project assessment and control”, intervals can be determined
(as defined in
...