The map: how the SC 42 family fits together
Lesson 5 of 5 in The AI Standards Landscape and Core Terminology (ISO/IEC 22989).
Fourteen-plus documents sound overwhelming until you see the architecture. Think of the SC 42 catalogue as a city: 22989 and 23053 are the street grid (shared vocabulary and reference framework). 42001 is city hall — the one certifiable management system everything else reports into. Around it, three rings:
- Process guidance that plugs into specific 42001 clauses: 23894 (how to run the clause 6 risk assessment, adapting ISO 31000), 42005 (how to run the clause 6.1.4 / 8.4 impact assessment).
- Topic guidance that seeds your objectives and tests: TR 24028 (trustworthiness), TR 24027 (bias), TR 24368 (ethics), 25059 (AI quality model, extending the SQuaRE family), the 5259 series (data quality for ML, parts 1–5), 24029 (neural-network robustness), TS 4213 (classification performance measurement).
- Assurance infrastructure: 42006 tells certification bodies how to audit an AIMS competently; 38507 (from SC 40, with SC 42) tells boards how to govern the whole picture.
Every arrow points the same way: guidance feeds the management system; the management system generates the evidence; the assurance layer checks it.
| Standard | Type / year | What it gives you | Where it plugs in |
|---|---|---|---|
ISO/IEC 22989 | IS, 2022 | Concepts and terminology — the normative dictionary | Normative reference for nearly everything, including 42001 |
ISO/IEC 23053 | IS, 2022 | Framework for AI systems using machine learning | Reference architecture for lifecycle and data controls |
ISO/IEC 42001 | IS, 2023 (18 Dec) | Requirements for an AI management system — certifiable | The hub: everything else feeds it or audits it |
ISO/IEC 23894 | IS (guidance), 2023 | AI risk management guidance, adapting ISO 31000 | 42001 clause 6.1.2 / 8.2 risk assessment |
ISO/IEC 42005 | IS (guidance), 2025 (28 May) | AI system impact assessment process | 42001 clause 6.1.4 / 8.4 and control A.5 |
ISO/IEC 42006 | IS, 2025 (7 Jul) | Extra requirements for bodies auditing and certifying AIMS | Governs your certification body, not you |
ISO/IEC TR 24028 | TR, 2020 | Trustworthiness overview: attributes, threats, mitigations | Seeds objectives (Annex C) and test plans |
ISO/IEC TR 24027 | TR, 2021 | Bias taxonomy and fairness concepts | Bias controls, testing, and monitoring metrics |
ISO/IEC TR 24368 | TR, 2022 | Ethical and societal concerns overview | Board values, policy content, impact-assessment lenses |
ISO/IEC 25059 | IS, 2023 | Quality model for AI systems (extends SQuaRE/25010) | Quality characteristics for specs and clause 9 metrics |
ISO/IEC 5259 series | IS series, 2024– | Data quality for analytics and ML (parts 1–5) | Data controls (A.7); adopted in Europe as EN ISO/IEC 5259 |
ISO/IEC 38507 | IS (guidance), 2022 | Governance implications of AI for governing bodies | Board level — wraps around the whole AIMS |
Which standard do I reach for?
Interactive decision tree — outcomes:
- ISO/IEC 42001
The AI management system standard — the only certifiable requirements document in the family. Everything else in this tree exists to feed it or check it.
- ISO/IEC 23894
AI risk management guidance built on the ISO 31000 skeleton. It tells you how to run the risk process that 42001 clause 6 requires you to have.
- ISO/IEC 42005
The AI system impact assessment standard (2025). Use it to satisfy 42001’s 6.1.4/8.4 requirement with the affected-party lens — individuals, groups, and societies.
- The Technical Reports: TR 24028, TR 24027, TR 24368
Informative, never certifiable — but they hand you the taxonomies (trustworthiness attributes, bias types, ethical themes) that make your objectives and test plans credible.
- ISO/IEC 25059, the 5259 series, 24029, TS 4213
The measurement wing: 25059 for the AI quality model, 5259 for data quality across the ML pipeline, 24029 for neural-network robustness, TS 4213 for classification performance.
- ISO/IEC 42006
Requirements for the bodies that audit and certify AIMSs, layered on ISO/IEC 17021-1. If a certificate matters to you, this standard is why it should be an accredited one.
- ISO/IEC 38507
Governance-of-AI guidance addressed to governing bodies. Evaluate–Direct–Monitor at board altitude, wrapping around the management system below.
- ISO/IEC 22989
The terminology standard. When two documents seem to disagree, check whether they are using words the 22989 way — most apparent conflicts dissolve.
AI standards publications, 2019–2026
- 2017-10-01 — ISO/IEC JTC 1/SC 42 established:
The AI standards committee forms — the machinery that will produce 22989, 23894, 42001, and the certification ecosystem.
- 2022-07-01 — ISO/IEC 22989 published:
AI concepts and terminology — the vocabulary layer every later standard builds on.
- 2023-02-01 — ISO/IEC 23894 published:
AI risk management guidance, extending ISO 31000 into AI — the bridge between enterprise risk language and AI-specific harms.
- 2023-12-18 — ISO/IEC 42001 published:
The world’s first certifiable AI management system standard — clauses 4–10 plus Annex A controls. The ISO 27001 playbook, rebuilt for AI.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.