ISO/IEC 38507:2022 is the international standard that guides boards and other governing bodies on how to govern their organisation's use of artificial intelligence. It was published in April 2022 as a first edition, it is guidance rather than certifiable requirements, and it builds on ISO/IEC 38500, whose current edition is ISO/IEC 38500:2024.
This guide is for directors, company secretaries, CIOs and the risk, compliance and audit staff who prepare AI matters for the board.
What is ISO/IEC 38507:2022?
Its full title is "Information technology: Governance of IT: Governance implications of the use of artificial intelligence by organizations". ISO's catalogue page lists it as edition 1, 28 pages, published on 8 April 2022. It was prepared jointly by two ISO/IEC JTC 1 subcommittees: SC 40 for IT governance and SC 42 for artificial intelligence.
The main audience is the governing body. The standard also names a wider group: executive managers, legal and other specialists, public authorities, service providers and consultants, and assessors and auditors.
It applies to any organisation, public or private, of any size. That holds whatever its dependence on data or IT. The standard reads "use of AI" broadly, covering development and application at any stage of an AI system's life cycle, and relationships with the parties who provide those systems. A company that only buys AI inside a vendor product is in scope.
What does each clause of ISO/IEC 38507 cover?
The guidance sits in clauses 4 to 6 and a normative Annex A. Clause 5 explains what makes AI different enough to need its own governance attention. Clause 6 then works through six policy areas a board should adapt for AI.
The right-hand column is AGS's view of a typical output for each clause. It is not the standard's wording.
| Clause | Topic | Typical board-level output (AGS view) |
|---|---|---|
| 4.2, 4.3 | Maintaining governance and accountability when AI is introduced | A statement of which AI decisions the board keeps and which it delegates, with named accountable roles |
| 5.2 | How AI differs from other IT: decision automation, data-driven problem-solving, adaptive systems | A briefing for directors on where these features appear in the organisation's own AI use |
| 5.3 to 5.5 | The AI ecosystem, benefits and constraints | An AI use-case inventory that includes AI bought from suppliers |
| 6.2 | Governance oversight of AI | Approval rules for new AI use cases and a reporting cycle to the board |
| 6.3 | Governance of decision-making | Criteria for when an automated decision needs human review or sign-off |
| 6.4 | Governance of data use | Rules on which data may be used to train or run AI, and who authorises it |
| 6.5 | Culture and values | An acceptable-use policy for AI tied to the organisation's values |
| 6.6 | Compliance obligations and compliance management | A register of legal and contractual obligations that apply to AI use |
| 6.7 | Risk: appetite, management, objectives, sources and controls | An AI risk appetite statement and an AI risk register reported to the board |
| Annex A | Governance and organisational decision-making | A decision map showing where AI sits in the organisation's decision chain |
How does ISO/IEC 38507 relate to ISO/IEC 38500:2024?
ISO/IEC 38507 is part of the ISO/IEC 38500 family and applies its governance thinking to AI. Its normative references list ISO/IEC 38500:2015 by date. That edition was current in 2022 but has since been withdrawn.
The current parent is ISO/IEC 38500:2024, the third edition. It replaced the six 2015 principles with eleven principles taken from ISO 37000, and it added "engage stakeholders" to the evaluate, direct and monitor model. Our ISO/IEC 38500:2024 guide explains the eleven principles and what changed.
In practice this means ISO/IEC 38507 still uses the 2015 vocabulary. If your board's IT governance framework already follows the 2024 edition, map the 38507 policy areas onto it rather than running two vocabularies.
A workable mapping, which is AGS's suggestion and not the standard's, is this. Oversight of AI (6.2) sits under the oversight principle, and data use (6.4) and decision-making (6.3) sit under data and decisions. Risk (6.7) sits under risk governance. Culture and values (6.5) sits under leadership and social responsibility.
How is ISO/IEC 38507 different from ISO/IEC 42001:2023?
They work at different levels. ISO/IEC 38507 tells the governing body what to consider. ISO/IEC 42001:2023, published in December 2023, specifies requirements for an AI management system that management establishes, runs and improves.
ISO/IEC 42001 is the one an organisation can be certified to. ISO/IEC 42006:2025, published in July 2025, sets the extra requirements for certification bodies that audit AI management systems against it. Both 38507 and 42001 take their AI terms from ISO/IEC 22989.
The two fit together. The board sets direction, risk appetite and accountability under ISO/IEC 38507. Management then turns that into the AI policy (42001 clause 5.2), the AI risk assessment (6.1.2) and the AI system impact assessment (6.1.4). Our ISO/IEC 42001 guide covers the management system side.
What should a board put in place first?
Most boards start with visibility. Ask management for an inventory of every AI use, including AI embedded in purchased software, chat assistants used by staff and supplier services that make decisions for you. Without it, the board cannot judge exposure.
Next, decide the delegation. Clause 4.3 deals with keeping accountability in place when AI is introduced, and delegating work to management or to a system does not remove the board's own accountability. Record which AI decisions come back to the board, for example new uses that affect customers, employees or regulated activities.
Then set the risk appetite for AI under 6.7. Say which uses are off limits, which need board approval and which management may approve. Tie this to the enterprise risk process, which our ISO 31000 and IEC 31010 guide describes.
Check the law that applies to you under 6.6. For organisations that place AI on the EU market, the AI Act (Regulation (EU) 2024/1689) is in force. Regulation (EU) 2026/1744 of 8 July 2026 moved the main high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in products covered by Annex I. Whether a system is high-risk depends on its use, so take legal advice on your own case.
Finally, agree the reporting. A board that approves an AI policy once and hears nothing until an incident cannot show oversight. Set a cycle for AI performance, incidents and risk reports, and an escalation route for serious AI incidents between meetings.
What records show a board is governing AI?
ISO/IEC 38507 does not prescribe records. When internal audit or an external reviewer looks at AI governance, they typically ask for evidence like this. The list is AGS's practical view.
- An AI governance policy or charter approved by the board, with its review date.
- A delegation or RACI matrix for AI decisions.
- The AI use-case inventory and the approval record for each significant use.
- An AI risk register with the board's risk appetite and the controls in place.
- Board or committee minutes that show AI items were discussed, challenged and decided.
- AI incident reports and the actions taken on them.
How AGS can help
The ISO IEC 38507-2022-Governance implications of the use of AI kit contains 43 editable Microsoft Word documents. They include an AI governance framework manual, a governance scheme with a policy-area map and 14 procedures, such as governance of AI decision-making. The 14 forms include an AI use-case inventory and a RACI matrix. There are 5 checklists, among them a clause 6 policy-area checklist, and 4 guidance documents.
Frequently asked questions
Can an organisation be certified to ISO/IEC 38507?
No. It is guidance for governing bodies, not a set of requirements for a certification audit. Organisations that want certification for AI use ISO/IEC 42001.
Is the 2022 edition still current?
Yes. ISO lists ISO/IEC 38507:2022 as the published first edition and shows no replacement. ISO reviews standards about every five years, so check the catalogue page before you plan.
Do we need a data science team for this to apply?
No. The standard applies whatever your dependence on data or IT, and buying AI from a supplier counts as use.
Where do the AI terms in the standard come from?
From ISO/IEC 22989:2022, the AI concepts and terminology standard, published in July 2022. ISO/IEC 38507 also uses the governance terms of ISO/IEC 38500.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by ISO, IEC or the European Union.
Reviewed October 2026. Facts checked against the sources current at publication.
