Redstrata Knowledge Base

ISO 22989 — AI Concepts and Terminology

8 min read

ISO 22989 — AI Concepts and Terminology

Created: 2026-08-17 Updated: 2026-08-17 Source count: 3

TL;DR

ISO/IEC 22989:2022 is the foundational vocabulary standard of the SC 42 AI corpus: 117 defined terms plus concept chapters covering AI paradigms, machine learning, the AI system life cycle, trustworthiness characteristics and stakeholder roles [S-2022-07-iso-iec-22989]. It is the terminology base the ISO/IEC 42001 ecosystem builds on, and a Phase 1 study text in Paul’s PECB 42001 Lead Auditor pathway [S-2026-07-18-pecb-42001-la-exam-prep]. Its load-bearing ideas for audit work: the AI system definition, the stakeholder role taxonomy (including AI auditor), the life cycle model, and the trustworthiness vocabulary.

Key Points

  • Defines an AI system as an “engineered system that generates outputs such as content, forecasts, recommendations or decisions for a given set of human-defined objectives” — the anchor definition reused across SC 42 standards [S-2022-07-iso-iec-22989].
  • Contains 117 terms in seven groups: AI general (3.1), data (3.2), machine learning (3.3), neural networks (3.4), trustworthiness (3.5), NLP (3.6), computer vision (3.7); no normative references — it is the root of the terminology tree [S-2022-07-iso-iec-22989].
  • Replaces the philosophical weak/strong AI framing with narrow vs general AI; current systems are considered narrow, and general AI’s feasibility is explicitly left open [S-2022-07-iso-iec-22989].
  • “Knowledge” is a purely technical term (organised, abstracted information) — no cognition or understanding implied; the standard repeatedly disclaims anthropomorphism (“AI systems do not understand”) [S-2022-07-iso-iec-22989].
  • Sets a 7-level automation scale (0 no automation → 5 full automation, with 6 autonomy as the limiting case) and deliberately avoids calling automated AI systems “autonomous”, since they are not self-governing [S-2022-07-iso-iec-22989].
  • Distinguishes technical bias (essential to ML discrimination between cases) from unfairness (unjustified differential treatment) — a precise distinction auditors can use against loose “bias” claims [S-2022-07-iso-iec-22989].
  • Defines the trustworthiness characteristic set: robustness, reliability, resilience, controllability, explainability, predictability, transparency, accountability, bias/fairness — each with an AI-specific reading [S-2022-07-iso-iec-22989].
  • Gives an example (non-prescriptive) AI system life cycle: inception → design & development → verification & validation → deployment → operation & monitoring → continuous validation → re-evaluation → retirement, with risk management via ISO/IEC 23894 woven through every stage [S-2022-07-iso-iec-22989].
  • Defines the AI stakeholder role taxonomy: provider, producer, customer, partner (incl. AI auditor: audits organisations producing/providing/using AI systems for conformance to standards, policies or legal requirements; and AI evaluator), subject, relevant authorities [S-2022-07-iso-iec-22989].
  • Data roles are precisely separated — training, validation (tuning choices), test (disjoint evaluation), production data — with AI-specific meanings of “validation” and “test” that differ from software engineering usage [S-2022-07-iso-iec-22989].
  • Positioned in the 42001 ecosystem as the concepts/terminology layer beneath ISO/IEC 42001, 23894, 42005 and 42006 [S-2026-07-18-pecb-42001-la-exam-prep].

Detail

Clause map (study navigation)

ClauseContentStudy weight for 42001 LA
1–2Scope; normative references (none)Skim
3117 terms in 7 groups (3.1 AI, 3.2 data, 3.3 ML, 3.4 NN, 3.5 trustworthiness, 3.6 NLP, 3.7 CV)High — 3.1, 3.5 are core
4Abbreviated termsReference
5.1–5.9AI concepts: features of AI systems (interactive, contextual, oversight, adaptive); narrow/general AI; agent paradigm; knowledge; cognitive/semantic/soft computing; genetic algorithms; symbolic vs subsymbolic vs hybridMedium
5.10–5.12Data processes and roles; ML concepts (supervised/unsupervised/semi-supervised/reinforcement/transfer; retraining, drift, catastrophic forgetting, continuous learning); example algorithms (NN architectures, Bayesian networks, decision trees, SVM)Medium — data roles high
5.13Autonomy/heteronomy/automation Table 1 (levels 0–6)High
5.14IoT and cyber-physical systemsLow
5.15Trustworthiness: robustness, reliability, resilience, controllability, explainability, predictability, transparency, bias & fairnessHigh
5.16–5.18Verification vs validation; jurisdictional issues; societal impact risk factorsHigh
5.19AI stakeholder roles and sub-roles (Figure 2)High — incl. AI auditor
6AI system life cycle model (Figures 3–4), stages 6.2.2–6.2.9, ISO/IEC 23894 hooks at every stageHigh
7Functional view: model core; data/information; knowledge & learning (heuristic vs ML-based); prediction → decision → action; error-prone outputsMedium-high
8AI ecosystem layers: AI function, ML, engineering (expert systems, logic programming), big data, cloud/edge (3 training patterns), resource pools/ASICsLow-medium
9–10Fields (CV, NLP components, data mining, planning); applications (fraud detection, automated vehicles, predictive maintenance)Low
Annex AInformative mapping of the clause 6 life cycle to the OECD AI system life cycleMedium — regulator crosswalk

Concepts that do heavy lifting downstream

AI system definition (3.1.4). The “engineered system… human-defined objectives” formulation is the reference point for scoping an AIMS: what counts as an AI system determines what falls inside a 42001 certification boundary [S-2022-07-iso-iec-22989]. The supporting-standards framing places 22989 beneath 42001/23894/42005/42006 in the ecosystem [S-2026-07-18-pecb-42001-la-exam-prep].

Life cycle (clause 6). Explicitly an example, not a prescription — organisations choose their own model [S-2022-07-iso-iec-22989]. Distinctive AI deltas vs traditional software: data-driven behaviour, lower predictability, statistical rather than deterministic verification, iterative development, release management covering code + model + training-data diffs, and the extra continuous-validation stage for continuous-learning systems [S-2022-07-iso-iec-22989]. Every stage carries a risk-management hook pointing to ISO/IEC 23894 [S-2022-07-iso-iec-22989].

Trustworthiness vocabulary (5.15). Robustness = maintaining performance under any circumstances; reliability = consistently correct required function; resilience = recovery after incidents (degraded operation may be acceptable); controllability = an external agent can intervene; explainability = important decision factors expressible in human terms; predictability = stakeholders can make reliable assumptions about outputs (the standard warns a naïve human-prediction notion is subjective and that many ML approaches are “necessarily unpredictable” — statistical guarantees can matter more); transparency = communicating appropriate system and data information to stakeholders, which can conflict with security/privacy [S-2022-07-iso-iec-22989].

Verification vs validation (5.16). Verification = built correctly against specified requirements; validation = objective evidence the intended-use requirements are fulfilled; systems range from fully verifiable to unverifiable-and-unvalidatable [S-2022-07-iso-iec-22989]. Note the different AI-specific meanings of validation/test data in 5.10 — a known terminology trap [S-2022-07-iso-iec-22989].

Stakeholder roles (5.19). Provider (platform / product-or-service), producer (incl. developer sub-roles: model designer, model implementer, computation verifier, model verifier), customer/user, partner (system integrator, data provider, AI auditor, AI evaluator), subject (data subject, other subjects), relevant authorities (policy makers, regulators); an entity can hold multiple roles [S-2022-07-iso-iec-22989].

Prediction → decision → action (7.4). Outputs escalate from raw predictions through recommendations and decisions to actions affecting the real world; decision thresholds and human oversight sit between them; outputs are probabilistic and error-prone with accountability implications for using incorrect outputs [S-2022-07-iso-iec-22989].

Terminology traps worth memorising

  • “Prediction” does not imply the future — it is any first output (a translation, a classification) [S-2022-07-iso-iec-22989].
  • “Validation data” (AI: tuning/hyperparameter choices) ≠ “validation” (assessment sense, 5.16) [S-2022-07-iso-iec-22989].
  • “Bias” (technical, necessary) ≠ “unfairness” (unjustified differential treatment) [S-2022-07-iso-iec-22989].
  • “Autonomous” is avoided for AI systems; the top of the automation scale is a definitional limiting case [S-2022-07-iso-iec-22989].
  • “Knowledge”/“understanding” are non-cognitive technical terms [S-2022-07-iso-iec-22989].

Practical Applications

Exam & audit relevance (PECB 42001 LA pathway)

  • Phase 1 (Weeks 1–3) study text: 22989 concepts and terminology are the base layer before the 42001 requirements text; the pathway’s supporting-standards list names it first [S-2026-07-18-pecb-42001-la-exam-prep].
  • Audit scoping: the 3.1.4 AI system definition and 5.19 role taxonomy frame who the auditee is (provider vs producer vs customer) and what systems are in scope for an AIMS audit [S-2022-07-iso-iec-22989].
  • Audit evidence language: the 5.15 trustworthiness characteristics and 5.16 verification/validation distinctions give precise wording for findings — e.g. distinguishing a robustness deficiency from a reliability one, or technical bias from unfairness [S-2022-07-iso-iec-22989].
  • Life cycle walkthroughs: clause 6 stages (with their 23894 risk hooks) provide a natural audit trail structure for walking an AI system from inception to retirement, including the continuous-validation stage that only exists for continuous-learning systems [S-2022-07-iso-iec-22989].
  • Regulator crosswalk: Annex A’s OECD life cycle mapping is a ready-made bridge when clients frame their programmes on OECD definitions [S-2022-07-iso-iec-22989].
  • Open-book exam note: PECB exam rules permit a candidate-supplied hard copy of the main standard [S-2026-08-09-iso-standards-acquisition]. Paul’s 22989 copy is an ISO Store single-user licence (copying and networking prohibited), held read-only in _raw_sources/ and 12 ISO 42001 Lead Auditor\ [S-2022-07-iso-iec-22989].

Open Questions

  • Amendment exposure: an iso.org check (2026-08-17, web check — not yet an ingested Source page) found Amendment 1 “Generative AI” at draft/ballot stage and Amendment 2 registered. Will the exam/courseware reference the amended text, and does the 2022 edition’s silence on generative AI matter for IGA engagements scoping GenAI systems?
  • Which life cycle model will PECB courseware use — the 22989 clause 6 example, or another? (Same verification point as the ISO 19011 edition question at Week-3 enrolment [S-2026-08-09-iso-standards-acquisition].)
  • ISO/IEC 23894 is the risk-management companion invoked at every life cycle stage — until it is ingested, the risk hooks here cannot be traced clause-to-clause.

Sources

Graph View

Backlinks

Recently updated

See 113 more →