ISO/IEC 38507: ISO/IEC 38507 – Tutorial (about 60 minutes)

ISO/IEC 38507 is the international guidance standard that explains what changes for the people who govern an organisation when that organisation starts to use artificial intelligence (AI). It is written first for boards, councils, trustees and other governing bodies, and it is also read by executives, risk and compliance teams, auditors, consultants and engineers who build or buy AI. After this tutorial you will be able to explain why AI raises new governance questions, describe how the standard is organised, apply its policy areas to a real AI initiative and tell the difference between governing AI and managing AI.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: the current and only edition is ISO/IEC 38507:2022, Information technology – Governance of IT – Governance implications of the use of artificial intelligence by organizations, edition 1, published in April 2022 by ISO and IEC. It was prepared by ISO/IEC JTC 1/SC 42 (Artificial intelligence) in a joint working group with ISO/IEC JTC 1/SC 40 (IT service management and IT governance); the SC 42 business plan for 2025 records that joint work as complete. It is a guidance document (recommendations, not certifiable requirements). No amendment or new edition has been published, and none was announced in the committee documents we checked; ISO reviews every standard at least every five years, so a systematic review of the 2022 edition is due around 2027. Note that it was written when ISO/IEC 38500:2015 was the current edition of the parent governance-of-IT standard; ISO/IEC 38500 has since been revised (2024). Verified 2026-10-29 against the ISO and IEC catalogue entries and the SC 40 and SC 42 business plans.

Who it is for: board members and directors who must oversee AI without being AI specialists; chief executives, chief information, data, digital, risk and compliance officers; internal auditors and assessors; legal and ethics advisers; and engineers, product owners and data scientists who want to understand the governance expectations that their AI work will be judged against.

Prerequisites: none. A general picture of how an organisation makes decisions (a board sets direction, management runs the business) is helpful. You do not need to know how machine learning works; the tutorial explains the few technical ideas that matter for governance.

Learning objectives. After this tutorial you will be able to:

Explain why the use of AI creates governance implications that ordinary IT does not, and why accountability stays with the governing body.
Distinguish the role of the governing body from the role of management when an organisation adopts AI.
Describe the structure of ISO/IEC 38507: governance implications, the overview of AI systems, and the policy areas for using AI.
Apply the policy areas (oversight, decision-making, data use, culture and values, compliance and risk) to a concrete AI initiative.
Explain how governance of AI can be evaluated and why there is no organisational certification against ISO/IEC 38507.
Position ISO/IEC 38507 alongside ISO/IEC 38500, ISO/IEC 42001, ISO/IEC 23894, the NIST AI Risk Management Framework and AI regulation.

Lesson 1 – Origins, purpose and scope

Why a governance standard for AI?

Most organisations already govern their information technology in some way. Boards approve large technology investments, receive reports on cyber risk and expect the chief information officer to keep systems running. For decades that was enough, because traditional software does what its programmers told it to do. If a payroll system pays someone the wrong amount, the cause can be traced to a rule that someone wrote, and that person or team can fix it.

AI changes this picture in three ways that matter to the people at the top of an organisation. First, AI systems increasingly make or shape decisions – which loan applicant is approved, which patient is seen first, which candidate is invited to interview – that used to be made by accountable people. Second, many AI systems are built from data rather than written rules, so their behaviour depends on the quality, origin and bias of the data used to train them. Third, some AI systems keep changing after deployment as they are retrained or as the world around them shifts, so a system that was acceptable last year may not be acceptable today. Each of these features creates opportunities, and each creates risks that end up on the board's desk: legal exposure, reputational damage, unfair treatment of customers and staff, and loss of trust.

ISO/IEC 38507 was written to help governing bodies respond to this shift. Its central message is simple: using AI does not change who is accountable. The governing body remains answerable for everything the organisation does, including what it does through AI, and it cannot hand that accountability to a vendor, a data science team or the AI system itself. The standard then explains what the governing body needs to understand about AI and which policies it should put in place so that the organisation's use of AI is effective, efficient and acceptable.

Where it comes from

The standard belongs to the ISO/IEC 38500 family, the international series on governance of IT. ISO/IEC 38500 gives principles and a model that any governing body can use to direct and control the organisation's use of IT. When AI became a board-level topic, the two relevant committees – SC 40, which owns the governance-of-IT series, and SC 42, the international committee for AI standards – formed a joint working group to apply governance-of-IT thinking to AI. The result was published in 2022 as ISO/IEC 38507. Because it sits in the 38500 series, it uses the same language: a governing body that evaluates, directs and monitors, and managers who carry out the strategies and policies the governing body sets.

Scope

The scope is deliberately broad. The guidance applies to any kind of organisation – public or private companies, government bodies and not-for-profit organisations – of any size, whatever its degree of dependence on data or information technology. It covers the current use of AI and also uses the organisation is planning for the future. It looks at the implications of those uses for the organisation itself: for its ability to achieve its purpose, to meet its obligations and to create value for its stakeholders.

The standard takes a wide view of what counts as "use of AI". An organisation uses AI when it develops an AI system, when it applies one in its operations, and at any point in such a system's life, including through relationships with the third parties that supply or use these systems. A bank that buys a fraud-detection model from a vendor is using AI just as much as a start-up that trains its own model; both need governance.

Finally, the standard is explicit that it speaks to a wider audience than the board. Besides governing body members, it is meant to help executive managers; outside specialists such as lawyers, accountants and professional or industry associations; public authorities and policymakers; internal and external service providers, including consultants; and assessors and auditors. This matters in practice: an engineering team that understands the board's governance expectations can design AI systems that are easier to oversee.

What it is not

ISO/IEC 38507 is not a technical standard for building AI. It does not tell data scientists how to train a model, which fairness metric to use or how to test robustness; other SC 42 documents cover those topics. It is not a management system standard either, so it contains no auditable "shall" requirements and no certification scheme. It is guidance for the people who govern, with enough background on AI to let them ask the right questions.

Lesson 2 – Key concepts and vocabulary

Governance standards use ordinary words with precise meanings. The following terms are explained in our own words; the standard and its companion vocabulary documents give the formal definitions.

Governance – the system by which an organisation is directed, overseen and held accountable for achieving its purpose. It sets direction and boundaries; it does not run day-to-day operations.
Governing body – the person or group of people who are ultimately accountable for the whole organisation's performance and conduct, such as a board of directors, a council, a board of trustees or, in a small firm, the owner.
Management – the people and processes that run the organisation within the strategies, policies and limits that the governing body has set, and report back on results.
Governance of IT – the part of governance concerned with directing and controlling the current and future use of information technology, the subject of the ISO/IEC 38500 series.
Artificial intelligence (AI) – both a field of study and a family of technologies with which systems produce outputs such as predictions, recommendations, content or decisions for objectives that people define. The SC 42 vocabulary standard ISO/IEC 22989 gives the formal terminology.
AI system – an engineered system that uses AI techniques to generate such outputs; it may be a model inside a larger product, a cloud service or a stand-alone tool.
Use of AI – in the sense of the standard, developing or applying an AI system at any point in its life, including through relationships with parties that provide or use it.
Accountability – being answerable for decisions and actions and their consequences. The governing body keeps accountability for the organisation's use of AI; it can delegate tasks and authority, but not accountability.
Responsibility – the obligation to carry out a task or make a decision. Responsibilities can be assigned to managers and teams; the governing body remains accountable for how well that is done.
Oversight – the governing body's continuing activity of setting expectations, receiving information and checking that the organisation's use of AI stays within the agreed direction and limits.
Human oversight – arrangements that let competent people understand, supervise and, where needed, override or stop an AI system's outputs or actions.
Decision automation – the delegation of a decision, fully or partly, to an AI system, ranging from advice to a human, through a human checking each output, to fully automated decisions.
Adaptive system – an AI system whose behaviour can change after deployment, for example because it is retrained on new data or learns continuously.
AI ecosystem – the network of parties and components around an AI system: data providers, model and platform suppliers, integrators, cloud providers, users and the people affected by its outputs.
Risk appetite – the amount and type of risk an organisation is willing to pursue or accept in pursuit of its objectives; for AI it is set by the governing body and translated into limits by management.
Compliance obligations – the requirements an organisation must meet (laws, regulations, contracts) and the commitments it chooses to adopt (codes of conduct, ethical principles, voluntary standards).

Governance versus management

The most important distinction in the whole 38500 family is between governance and management. The governing body decides what the organisation should achieve with AI and within which limits, and it checks that this is happening. Management decides how to achieve it: which use cases to build, which vendor to choose, how to staff the data science team, how to test the model. Governance is done in close cooperation with management, but the two roles should not be confused. A board that starts choosing algorithms is doing management badly; a board that never asks what its AI systems decide about customers is not governing at all.

Evaluate, direct, monitor

ISO/IEC 38507 builds on the governance model of ISO/IEC 38500, in which the governing body governs through three main tasks. It evaluates the current and future use of AI, including proposals, risks and the pressures acting on the organisation. It directs by setting strategy, policies, risk appetite and responsibilities. It monitors performance and conformance, using reports, measures and independent assurance, and it adjusts direction when needed. The 2024 edition of ISO/IEC 38500 adds engaging stakeholders to this model; that addition is worth applying to AI as well, because AI affects customers, staff and the public directly.

Figure 1 – The governing body evaluates, directs and monitors the use of AI while managers implement it and report back; accountability stays with the governing body.

Lesson 3 – Structure of the standard

ISO/IEC 38507 is a short document. After the usual opening clauses it has three main clauses and an informative annex. Knowing this structure helps you find your way when you read the standard itself and helps you explain it to colleagues. The summaries below paraphrase the content; they do not reproduce the text.

Clauses 1 to 3 – Scope, normative references, terms and definitions

Clause 1 sets out the scope described in Lesson 1: guidance for governing bodies on enabling and governing the use of AI so that it is effective, efficient and acceptable, for all kinds and sizes of organisation, with a wider audience of managers, specialists, policymakers, service providers and auditors. Clause 2 is the normative references clause, and Clause 3 defines the terms used, drawing on the ISO/IEC 38500 series and the SC 42 AI vocabulary.

Clause 4 – Governance implications of the organisational use of AI

This clause is the heart of the argument. It explains that AI can let an organisation pursue new objectives and achieve existing ones more effectively and efficiently, and that these opportunities come with new risks and obligations. Its central theme is keeping governance and accountability intact when AI is introduced, which has two sides:

Maintaining governance – the governing body keeps setting direction, approving the organisation's purpose and limits, and overseeing results, rather than letting AI projects grow outside existing governance arrangements.
Maintaining accountability – the governing body remains accountable for decisions made with or by AI and keeps an ongoing responsibility to consider the implications of any new AI tool, technique or technology before and while it is used.

The standard also stresses that governance is not a one-off approval. Because AI systems can be introduced anywhere in the organisation – often embedded in software that was bought for another purpose – governance should apply throughout the life of an AI system, with checkpoints at each stage (Lesson 4 shows how).

Clause 5 – Overview of AI and AI systems

Clause 5 is a non-technical primer for governing body members. It explains what AI is and, more importantly, how AI systems differ from other information technologies. Three differences are emphasised:

Decision automation – AI systems can make or recommend decisions that people used to make, which shifts where judgement happens.
Data-driven problem solving – their behaviour is learned from data, so data quality, representativeness and provenance become governance topics.
Adaptive systems – their behaviour can change over time, so yesterday's assurance may not hold tomorrow.

The clause also describes the AI ecosystem (the suppliers, platforms, data sources and users involved), the benefits that AI can bring and the constraints that limit how it can be used.

Clause 6 – Policies to address the use of AI

Clause 6 turns understanding into action. It describes the areas in which the governing body should make sure appropriate policies exist and are followed:

Governance oversight of AI – how the governing body organises itself to oversee AI.
Governance of decision-making – which decisions may be delegated to AI, with what human involvement.
Governance of data use – how data used by AI is obtained, managed and protected.
Culture and values – how AI use reflects the organisation's values and ethical commitments.
Compliance – covering both compliance obligations and compliance management for AI.
Risk – covering risk appetite, risk management, objectives, sources of risk and risk controls for AI.

Annex A – Governance and organisational decision-making

The informative annex gives background on governance for readers who are new to it, in particular how governance by the governing body relates to decision-making across the organisation. It is useful when explaining governance to technical teams.

Figure 2 – The main parts of ISO/IEC 38507: why governance changes (Clause 4), what AI is (Clause 5) and where policies are needed (Clause 6).

A useful way to remember the structure is as three questions. Clause 4 answers "why must governance change?", Clause 5 answers "what do we need to understand about AI?", and Clause 6 answers "where do we need policies?". The standard leaves the "how exactly?" to management, to other SC 42 standards and to the organisation's own frameworks.

Lesson 4 – How it works in practice

Because ISO/IEC 38507 is guidance, there is no mandatory implementation sequence. In practice, organisations that adopt it follow a pattern that combines the 38500 governance model with the policy areas of Clause 6. This lesson describes that pattern, the roles involved and the artefacts that typically result.

Step 1 – Establish the starting point

The governing body first needs to know where AI is already used. In many organisations AI arrives quietly: a marketing tool with a recommendation engine, a recruitment platform that ranks CVs, a coding assistant used by developers, a chatbot on the website. Management prepares an inventory of AI systems and use cases, including those supplied by third parties, with their purpose, owner, data used and the decisions they influence. The governing body evaluates this picture against the organisation's strategy and obligations.

Step 2 – Set direction and appetite

Next the governing body decides what the organisation wants from AI and what it will not accept. This usually produces an AI strategy or a section of the business strategy, a statement of risk appetite for AI (for example, no fully automated decisions that significantly affect individuals without human review), and a set of principles that express the organisation's values in AI terms, such as fairness, transparency, privacy and safety. The standard's emphasis on culture and values means these principles should be the organisation's own, not copied slogans.

Step 3 – Organise oversight

The governing body decides how it will oversee AI. Options include giving the topic to an existing committee (risk, audit or technology), creating a dedicated committee, or holding regular full-board sessions. Management is typically asked to appoint an accountable executive for AI, to create a cross-functional group (technology, data, legal, risk, ethics, business owners) and to define reporting lines. The governing body also checks that its own members have enough understanding of AI to challenge management; Clause 5 exists precisely to support that.

Step 4 – Put policies in place

Management drafts, and the governing body approves or endorses, policies for each Clause 6 area. Typical artefacts are an AI use policy (what staff may and may not do with AI tools), a decision-delegation policy (which decisions may be automated and with what human involvement), data governance rules for AI (sources, consent, quality, retention), an AI risk management procedure linked to the enterprise risk framework, and a compliance register of AI-related legal and contractual obligations. Existing policies – on privacy, information security, procurement and conduct – are reviewed so they cover AI rather than duplicating them.

Step 5 – Govern each AI system through its life

Governance then becomes part of the life of every AI system. A presentation by the SC 42 joint working group convenor describes this as a "governance gating process": at each stage of the AI life cycle there is a point where the system must meet the organisation's policies before it moves on. The stages can be named in many ways; a simple version is inception, design, development, operation and retirement.

Figure 3 – Governance gates along the AI life cycle: each stage passes a checkpoint, and systems in operation are re-checked until they are retired.

The gates do not mean the board approves every model. The governing body sets the criteria and decides which kinds of system need its own attention (for example, those with high impact on people or high financial exposure); management operates the gates for everything else and reports on how they are working.

Step 6 – Monitor and adapt

Finally, the governing body monitors. Typical reporting includes the AI inventory and how it is changing, key risk indicators (incidents, complaints, model drift, override rates, data breaches), compliance status, results of internal audits or independent assessments, and progress towards the value the AI was meant to create. When monitoring shows a problem – a model that has drifted, a new law, a change in public expectations – the governing body re-evaluates and redirects. This closes the evaluate–direct–monitor loop from Figure 1.

Roles in summary

Role	Typical contribution to governing AI
Governing body	Sets AI direction, values and risk appetite; approves key policies; oversees high-impact uses; remains accountable.
Executive management	Translates direction into plans; appoints owners; runs the life-cycle gates; reports honestly on performance and risk.
AI system owners	Answer for a specific system's purpose, data, performance and human oversight arrangements.
Risk, compliance, legal and ethics functions	Advise on obligations and risks; challenge proposals; maintain registers and procedures.
Internal audit and external assessors	Provide independent assurance that governance arrangements exist and work.
Suppliers and service providers	Provide information and contractual commitments that let the organisation govern AI it does not build itself.

Lesson 5 – Assessment, certification and compliance

No certification against ISO/IEC 38507

ISO/IEC 38507 contains recommendations, not requirements. There is therefore no accredited certification scheme in which an organisation can be audited and certified "to ISO/IEC 38507", and any claim of such certification should be treated with caution. An organisation can, however, state that its governance of AI is aligned with or informed by the standard, and it can ask for that alignment to be assessed. Some training providers offer courses on the 38500 family or on AI governance; such personal certificates show that an individual completed training, not that an organisation conforms.

How governance of AI is assessed

Several routes give the governing body and its stakeholders confidence that AI is well governed:

Board self-evaluation – the governing body periodically reviews whether it understands the organisation's AI use, whether it receives the right information and whether its oversight arrangements work.
Internal audit – auditors test whether AI policies exist, are known and are followed, whether the AI inventory is complete, and whether life-cycle gates are operated as designed. The standard explicitly counts assessors and auditors among its readers.
Assessment of governance of IT – ISO/IEC 38503 gives guidance on assessing governance of IT against the ISO/IEC 38500 approach. Because AI is a use of IT, its approach can be applied to the governance of AI, using ISO/IEC 38507 to define what good looks like.
Management system certification – an organisation that wants a certificate can implement an AI management system according to ISO/IEC 42001 and be certified by an accredited body. A 42001 certificate shows that management has a working system for AI; it does not by itself prove that the governing body is fulfilling its role, which is the concern of ISO/IEC 38507.
Regulatory supervision – in sectors and jurisdictions with AI-specific rules, supervisors may examine governance arrangements; the EU AI Act, for example, places obligations on providers and deployers of high-risk AI systems, including human oversight and risk management.

What evidence looks like

Because the standard is principle-based, evidence is about substance rather than checklists. Useful evidence includes board and committee minutes that show real discussion and challenge on AI; an approved AI strategy and risk appetite; policies covering each Clause 6 area with named owners; a current AI inventory with risk ratings; records from life-cycle gates, including decisions to stop or change systems; incident and complaint logs with follow-up; training records for board members and staff; and contracts that give the organisation the information it needs from AI suppliers. An assessor will also look for consistency: a stated value of transparency should be reflected in how customers are told about AI-driven decisions.

Compliance as one of the policy areas

Do not confuse "compliance with ISO/IEC 38507" with the compliance policy area inside it. The standard asks the governing body to make sure the organisation identifies its compliance obligations related to AI – data protection, consumer protection, anti-discrimination, sector rules, AI-specific laws, contracts and voluntary commitments – and has compliance management to meet them. That is compliance with external and self-imposed obligations, which the standard helps the organisation govern; it is not compliance with the standard itself.

Lesson 6 – Worked example

Harbourline Mutual is a fictional mid-sized insurer with about 2,000 employees, a board of nine non-executive and executive directors, and a growing interest in AI. Its claims department wants an AI system that sorts incoming claims, flags likely fraud and fast-tracks simple claims for automatic payment. Its staff have also started using public generative AI tools to draft letters. The board decides to use ISO/IEC 38507 as its reference for governing AI. Here is how it proceeds, step by step.

1. Understanding the current position (evaluate)

The board asks the chief operating officer for an AI inventory. The first version lists the planned claims-triage system and nothing else. Internal audit points out that the inventory misses a fraud-scoring feature built into the claims platform the company already licenses, a marketing tool that predicts which customers may leave, and the unmanaged use of generative AI. The revised inventory shows seven uses of AI, three of them supplied by vendors. The board learns its first lesson: AI often enters through procurement and staff behaviour, not only through projects.

2. Building board understanding

Two directors have technology backgrounds; the others do not. Using the themes of Clause 5, the company secretary arranges a two-hour session on how AI systems differ from conventional software: they automate decisions, they learn from historical claims data that may contain past bias, and the fraud model will be retrained quarterly, so its behaviour will change. Directors leave able to ask practical questions: "What data was this trained on?", "Who can override it?", "How will we know if it starts to drift?"

3. Setting direction and appetite (direct)

The board approves an AI statement with three elements. Its purpose is to use AI to settle simple claims faster and to detect fraud more accurately, without making the claims experience less fair. Its risk appetite allows AI to recommend outcomes but not to deny a claim or cancel a policy without a qualified person reviewing the case; automatic payment of small, low-risk claims is allowed. Its values commit Harbourline to fairness across customer groups, to telling customers when AI was involved in handling their claim, and to protecting personal data.

4. Organising oversight

The board gives AI oversight to its existing risk committee, extending its terms of reference rather than creating a new committee. It asks management to name the chief operating officer as accountable executive for AI and to set up an AI review group with members from claims, data science, legal, compliance, information security and customer experience. The risk committee will receive a quarterly AI report and review any high-impact system before it goes live.

5. Policies for each area

Policy area	What Harbourline puts in place
Governance oversight	Risk committee mandate; accountable executive; AI review group; quarterly reporting.
Decision-making	Delegation rules: AI may fast-track and recommend, but denials and cancellations need human review; staff can override and must record why.
Data use	Approved data sources for training; checks for missing or skewed data; retention limits; a ban on entering customer data into public AI tools.
Culture and values	AI principles linked to the code of conduct; staff guidance on approved generative AI tools; a channel to raise concerns.
Compliance	Register of AI-related obligations (data protection, insurance conduct rules, anti-discrimination law, contracts); compliance reviews at life-cycle gates.
Risk	AI risks added to the enterprise risk register; risk sources such as bias, drift, supplier failure and misuse; controls and key risk indicators.

6. Applying the gates to the claims-triage system

At inception, the business case states the expected benefit (faster settlement of simple claims) and the decisions the system will influence. At the design gate, the review group asks how human review will work in practice and whether claims handlers will have time to examine recommendations properly; the design is changed so that every proposed denial goes to a handler with the reasons shown. Before go-live, testing shows the fraud flag fires more often for claims from one postcode area. The data science team traces this to historical investigation patterns rather than real fraud rates, adjusts the model and adds fairness monitoring. The risk committee reviews the results and approves a limited launch for one product line.

7. Monitoring and adapting (monitor)

Quarterly reports show settlement times falling, handler override rates, complaint numbers and fairness indicators. Six months in, the override rate for the fraud flag rises sharply; investigation shows that a change in the claims form altered the input data. The model is paused, corrected and re-approved through the operation gate. Meanwhile the vendor-supplied churn model is found to use data in a way the privacy team had not reviewed; the contract is renegotiated to give Harbourline the information it needs. The board's annual self-evaluation concludes that oversight is working but that the inventory process must be repeated twice a year.

What the example shows

Harbourline did not need a new bureaucracy. It used its existing board, committee, risk framework and policies, and it extended them to cover the features that make AI different. The board stayed out of technical choices but set clear limits, asked informed questions and insisted on information. Accountability never moved: when the fraud flag misbehaved, the question was what Harbourline would do, not what the model had done.

Lesson 7 – Relationship to other standards and frameworks

ISO/IEC 38507 is one piece of a larger landscape. It answers questions for the governing body; other documents answer questions for management, engineers and regulators. Knowing how they fit together helps you avoid both gaps and duplication.

Figure 4 – ISO/IEC 38507 applies governance-of-IT thinking to AI for the governing body, while management-level standards such as ISO/IEC 42001 put that direction into practice.

Standard or framework	Main audience	Type	How it relates to ISO/IEC 38507
ISO/IEC 38500:2024 – Governance of IT for the organization	Governing bodies	Guidance (principles, model, framework)	The parent standard; ISO/IEC 38507 applies its approach to AI. The 2024 edition adds stakeholder engagement and alignment with ISO 37000.
ISO/IEC 42001:2023 – AI management system	Management and practitioners	Requirements; certifiable	Gives the management system through which direction set under ISO/IEC 38507 can be implemented and audited.
ISO/IEC 23894:2023 – AI risk management guidance	Risk managers and practitioners	Guidance based on ISO 31000	Detailed help for the risk policy area: identifying, analysing and treating AI risks.
ISO/IEC 22989:2022 – AI concepts and terminology	Everyone working with AI	Vocabulary and concepts	Supplies the shared AI terms that governance documents use.
ISO/IEC 42005:2025 – AI system impact assessment	System owners and practitioners	Guidance	A method for assessing effects on people and society, useful at life-cycle gates.
NIST AI Risk Management Framework 1.0 (2023)	Organisations of all kinds	Voluntary framework	Its Govern function covers similar ground on culture, accountability and policies; Map, Measure and Manage go deeper into risk practice.
EU AI Act – Regulation (EU) 2024/1689	Providers and deployers of AI in the EU	Law	A source of compliance obligations that the governing body must ensure are identified and met.

Governance and management working together

The most common pairing in practice is ISO/IEC 38507 with ISO/IEC 42001. Think of ISO/IEC 38507 as the board's lens and ISO/IEC 42001 as management's engine. The board uses ISO/IEC 38507 to decide what it expects from AI and how it will oversee it; management builds an AI management system to deliver those expectations consistently, with policies, objectives, risk and impact assessments, controls, internal audit and management review. If the organisation seeks certification, it certifies the management system, while the board's oversight remains a governance matter.

Data governance and broader governance

Because AI depends on data, ISO/IEC 38507 also connects to the ISO/IEC 38505 series on governance of data, which applies governance-of-IT ideas to the value, risk and constraints of data. At the top of the hierarchy, ISO 37000 gives general guidance on governing organisations, which the 2024 edition of ISO/IEC 38500 aligns with. Sector frameworks, such as those for financial services model risk or medical devices, add more detailed expectations in regulated industries.

Choosing what to use

A small organisation that only uses a few AI-enabled tools may need little more than a board briefing, an AI use policy and a line in the risk register, guided by ISO/IEC 38507. A large organisation building AI products for sale will typically combine ISO/IEC 38507 for board oversight, ISO/IEC 42001 for its management system, ISO/IEC 23894 and ISO/IEC 42005 for risk and impact assessment, and the applicable regulation. The standards are designed to be combined rather than chosen between.

Common pitfalls and best practices

Common pitfalls

Treating AI as purely a technology matter. When AI is left entirely to the IT department, decisions about customers, staff and reputation are made without the governing body's direction.
Blaming the algorithm. Saying "the model decided" does not move accountability. Regulators, courts and the public hold the organisation and its leaders answerable.
An incomplete view of AI use. Inventories that list only internal projects miss AI embedded in purchased software, cloud services and staff use of public tools.
One-time approval. Approving a system once and never revisiting it ignores the fact that adaptive systems and their environments change.
Human oversight in name only. A person who must approve hundreds of AI recommendations an hour without time, information or authority to disagree is not providing real oversight.
Copying principles without living them. Publishing AI ethics principles that are not reflected in incentives, policies and decisions erodes trust.
Confusing governance with management. Boards that try to choose models or vendors neglect their real role, while management that sets its own risk appetite exceeds its mandate.

Best practices

Start with an inventory. Build and maintain a register of all AI use, including third-party and embedded AI, with owners and risk ratings.
Invest in board understanding. Give directors regular, practical briefings so they can challenge management with confidence.
Write down the risk appetite. State which decisions may be automated, which require human review and which uses are off-limits.
Extend existing structures. Fit AI into existing committees, risk frameworks and policies before creating new ones.
Govern the whole life cycle. Use gates from inception to retirement, with re-assessment triggered by changes in data, model, use or law.
Make oversight meaningful. Design human review so that reviewers have time, explanations, training and the authority to override.
Govern suppliers too. Use contracts to obtain the information, testing evidence and notification of changes you need for vendor AI.
Combine with management standards. Use ISO/IEC 42001 and related standards to turn governance direction into consistent practice and evidence.

Summary and key takeaways

ISO/IEC 38507:2022 is the current, first-edition guidance standard on the governance implications of an organisation's use of AI, developed jointly by ISO/IEC JTC 1/SC 42 and SC 40.
Its core message is that the governing body remains accountable for everything the organisation does with AI and cannot delegate that accountability to people, suppliers or systems.
It applies the ISO/IEC 38500 approach – evaluate, direct and monitor, in cooperation with management – to AI, for organisations of every type and size.
Clause 4 explains why governance must adapt, Clause 5 explains what makes AI different (decision automation, learning from data, adaptivity and a wide ecosystem), and Clause 6 lists the policy areas.
The policy areas are governance oversight, decision-making, data use, culture and values, compliance and risk.
Governance should apply throughout the AI life cycle, with gates where systems must meet policy before moving on and regular re-checks in operation.
There is no certification against ISO/IEC 38507; assurance comes from board evaluation, internal audit, governance assessment and, at management level, ISO/IEC 42001 certification.
It works best combined with ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 42005, frameworks such as the NIST AI RMF and the applicable law.

Reflection questions

List every way your organisation uses AI today, including features inside purchased software and staff use of public tools. Which of these would a board member be surprised to learn about?
Pick one decision that AI influences in your organisation. Who is accountable for it, who is responsible for the AI system, and how would an affected person challenge the outcome?
Write a two-sentence risk appetite statement for AI in your organisation. Which uses would it allow, and which would it rule out?
For one AI system you know, describe what a governance gate at the design stage and at the operation stage should check, and what would cause the system to be paused.
If your organisation already has, or is planning, an ISO/IEC 42001 management system, which questions would still need to be answered by the governing body using ISO/IEC 38507?