ISO/IEC 22989 — the vocabulary everything else builds on

Lesson 4 of 5 in The AI Standards Landscape and Core Terminology (ISO/IEC 22989).

Every legal system starts with a definitions section, and so does the standards ecosystem. ISO/IEC 22989:2022 — Artificial intelligence concepts and terminology — is the normative dictionary the rest of the SC 42 catalogue imports. When ISO/IEC 42001 says "AI system", it means the 22989 definition; when 23894 talks about the AI lifecycle, it means the 22989 lifecycle. Get these terms wrong and every downstream document silently means something different to you than to your auditor.

The load-bearing definitions:

  • AI system — an engineered system that generates outputs such as content, forecasts, recommendations or decisions for a given set of human-defined objectives. Notice the family resemblance to the OECD and EU AI Act definitions — 22989 fed both conversations.
  • Machine learning — the process by which a model’s behaviour is optimised from data rather than explicitly programmed; the resulting model is the mathematical construct that turns inputs into outputs.
  • Training, validation, and test data — three disjoint jobs: training data fits the model’s parameters; validation data steers development choices (architecture, hyperparameters, when to stop); test data delivers the final, untouched exam. Reusing test data during development quietly destroys its meaning — a classic audit finding.
  • inference — the runtime act of the trained model producing outputs from new inputs. Training happens in the lab; inference happens in the world.

Symbolic AI

Knowledge-driven. Humans encode facts and rules explicitly — logic, ontologies, expert systems — and the machine reasons over them. Behaviour is inspectable line by line, which makes governance straightforward but capability brittle: nobody can hand-write the rules for recognising a face. 22989 keeps the term alive because hybrid systems still embed symbolic components (business-rule layers around an ML core), and each component carries different risks.

Sub-symbolic AI

Data-driven. Behaviour is learned as numeric parameters — the connectionist world of machine learning and neural networks. Capability scales with data and compute; inspectability collapses. This is where the black-box problem lives, and why the trustworthiness standards (TR 24028, 24029 series) spend their pages on testing, robustness, and explainability approximations rather than line-by-line review.

Why the split matters

Governance treatment follows the paradigm. A symbolic rule engine can be audited by reading it; a sub-symbolic model must be audited by behavioural evidence — test suites, disaggregated metrics, monitoring. When your inventory mislabels a learned component as "just business rules", every downstream control is calibrated wrong. 22989 gives you the vocabulary to record the distinction precisely.

Autonomy, heteronomy, and the automation spectrum. 22989 formalises an idea you met in Foundations: systems range from fully heteronomous (operating only under external human control) to fully autonomous (operating without human intervention, even updating their own objectives within design bounds). Between the poles sit graded automation levels — the standard deliberately mirrors the driving-automation ladder. An AI agent, in 22989 terms, is an automatic entity that senses and acts upon its environment to achieve its objectives — the definitional hook that later agentic-AI governance hangs from.

Why does a vocabulary standard care? Because oversight requirements scale with autonomy, and you cannot write a defensible oversight policy without an agreed scale to place systems on.

Who is who: the 22989 stakeholder roles. The standard names the cast that every later document assigns duties to. An AI provider offers AI products or services (platform providers, product providers). An AI producer designs, develops, tests and deploys them — the AI developer is a sub-role here. An AI customer procures or uses them, with the hands-on AI user as its sub-role. AI partners orbit the value chain: system integrators, data providers, evaluators, auditors. AI subjects are the people the system acts upon — data subjects and anyone affected by outputs. And relevant authorities — regulators, policymakers — watch the whole stage.

One organisation routinely wears several hats at once: a bank that builds its own credit model and buys a vendor chatbot is producer, provider (to its customers), and customer simultaneously. ISO/IEC 42001 clause 4 will force you to write those roles down — so practise spotting them now.

Interactive sorting exercise: Assign each actor to its ISO/IEC 22989 stakeholder role.

The 22989 AI system lifecycle. The standard closes with the stage model the whole ecosystem reuses: inception → design and development → verification and validation → deployment → operation and monitoring → re-evaluation → retirement. Two features distinguish it from a generic software lifecycle. Re-evaluation is an explicit stage — a standing admission that AI systems drift and must be formally reassessed, not just patched. And retirement is in scope: decommissioning a model raises real questions (what happens to its training data, its logs, the decisions it made?) that governance must answer.

A companion document, ISO/IEC 23053, zooms into the machine-learning portion of that lifecycle — a framework describing the ML pipeline (data acquisition, training, evaluation, deployment) for systems that learn. Together, 22989 and 23053 are the reference architecture that ISO/IEC 42001’s Annex A lifecycle controls will assume you know.

Key terms: AI system, machine learning, inference, verification, validation, AI lifecycle

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.