ISO/IEC 23053 describes how to talk about an AI system that learns from data. It applies to every kind and size of organisation that implements or uses such a system.
What the base framework establishes
The scope provision says the document provides a structure for the description of an AI system built on machine learning. It covers the parts of the system and what each part does inside the wider AI ecosystem. It names public companies, private companies, government bodies and not-for-profit organisations as the kinds of user it has in mind, and it does not restrict itself by size. It is a description standard, not a set of duties: an organisation does not become conformant by meeting it, and no certificate is issued against it. Its practical value is a shared map that a governance team, an engineering team and an auditor can point at when they argue about what an AI system contains.
Why it matters to an AI management system
Most arguments about AI governance stall because two teams mean different things by model, data or task. The scope clause is the anchor: it says the framework exists to make those words mean the same thing across an organisation and across standards. Read it before adopting any other AI standard, and read it again when a vendor describes a system in vocabulary your team does not share.
The public draft summary names no change to 1 Scope. The final text could still touch it.
Evidence a reviewer samples
| Category | Artefact |
|---|---|
| Scope decision | A signed note that records whether the framework is adopted, and for which systems. |
| System inventory | The list of ML-based AI systems the organisation builds, buys or operates. |
| Role statement | The name of the accountable owner for the AI system description. |
One question to prepare for. If an auditor asked which of your systems this framework describes, could you answer without opening a repository?
Common gaps
- The organisation adopts the framework without deciding which systems it covers.
- The inventory mixes classical software with ML systems and cannot be read as a scope.
- Nobody is named as the owner, so the description goes stale after the first quarter.
Prepare before publication
Write a one-page scope decision: which systems are ML-based, which use generative models, and who owns the description. Keep it beside the 42001 scope statement so the two cannot drift.
Dates that matter
No separate date attaches to 1; the record dates are the stage date, the planning estimate and the CEN expectation stated above.
Cross-references
5 Overview · 6.1 Overview of the machine learning system · 8.1 General
Source
Source for 1: ISO/IEC 23053:2022, clause 1. The statement is read from the public base sample at 1 and is written in our words. The two official records are linked on this page so any line can be checked.
Not legal advice; does not certify. A reading of the framework and the evidence a reviewer commonly samples, not a substitute for the standard or your auditor's rules.