ISO 38507 AI governance and requirements, so the board stays accountable for every AI decision.

What it is

What is ISO 38507 and what is it used for?

ISO/IEC 38507 is the international guidance on what the use of artificial intelligence means for the people who govern an organisation. It was developed jointly by the ISO/IEC subcommittees for IT governance and for AI, and it applies to organisations of every type and size, whether they build AI, use it inside a software service or are only considering it.

Its starting point is simple and demanding: the governing body stays accountable for everything the organisation does, and that accountability cannot be handed to a machine or to a supplier. AI changes how decisions are made, how data is used and how quickly things can go wrong, so the guidance asks directors to check whether their existing oversight, policies and risk appetite still hold once AI is in use. Boards use it to set the questions they ask management, to decide which AI uses need their approval and to show investors, regulators and customers that someone senior is in charge.

Current edition. ISO/IEC 38507:2022, published in April 2022, is the first edition. ISO lists it as under systematic review, the routine check that decides whether a standard is confirmed, revised or withdrawn; no revised edition has been published, so there is nothing to transition to today. It builds on the governance model of ISO/IEC 38500, which has its own page on this site, and on AI terminology from ISO/IEC 22989.

Who it is for

Who needs ISO 38507 AI governance?

The guidance is written for directors, but the work lands on the people who report to them: the chief executive, the risk and compliance functions, the data and technology leads and internal audit. Organisations come to Sterling for ISO/IEC 38507 from four starting points:

• Customers want to know who answers for your AI. Enterprise buyers now ask suppliers how AI in their service is approved, monitored and stopped when needed. A board-level governance framework gives your sales and procurement teams a credible answer.
• A tender or investor asks about AI oversight. Public bodies, lenders and investors increasingly include AI governance questions in due diligence. The guidance gives you a recognised structure for your response.
• Regulators expect senior accountability. AI rules and sector supervisors look for named responsibility at the top. ISO/IEC 38507 helps the board show how it directs and oversees AI use, alongside the advice of your legal advisers.
• The group needs one approach across its companies. Subsidiaries adopt AI tools at different speeds. A common set of board policies and reporting lines lets the parent see where AI is used and where risk sits.

The benefit comes from directors who ask better questions and act on the answers, not from adopting the document alone.

Requirements

What are the main ISO 38507 requirements?

Strictly, ISO/IEC 38507 contains guidance rather than auditable requirements, so no organisation claims conformity with it in the way it would with a certifiable standard. What it expects of a governing body is set out in three main clauses and a normative annex, summarised here at title level:

• Clause 4 Governance implications of the organisational use of AI: keep governance and accountability intact when AI is introduced, including the rule that directors, not systems, answer for outcomes.
• Clause 5 Overview of AI and AI systems: understand how AI differs from other technology, through decision automation, data-driven problem-solving and adaptive behaviour, and the wider AI ecosystem.
• Clause 5 Benefits and constraints of the use of AI: weigh what AI can deliver against the limits on its use before approving it.
• Clause 6 Governance oversight of AI: set policies for how the board oversees AI use across the organisation.
• Clause 6 Governance of decision-making: decide which decisions AI may inform or take, and where human judgement stays.
• Clause 6 Governance of data use: direct how data is used by and for AI systems.
• Clause 6 Culture and values: make sure AI use reflects the behaviour the organisation expects of its people.
• Clause 6 Compliance: identify compliance obligations for AI and oversee how they are managed.
• Clause 6 Risk: set risk appetite for AI, oversee risk management, objectives, sources of risk and controls.
• Annex A Governance and organisational decision-making: relates the guidance to wider governance of organisations.

Implementation route

How do you implement ISO 38507?

Because there is no certificate, the route is about adoption and proof rather than an external audit. Sterling works with the board and management to put the guidance into practice; where a customer needs certified assurance, the same work becomes the foundation for an ISO/IEC 42001 management system that an accredited body can certify.

1. 01
   Agree what the board needs to govern.List the AI in use or planned, including AI inside purchased software, and confirm which governing body and committees are in scope.
2. 02
   Gap analysis: compare current oversight with the guidance.Review policies, delegations, risk appetite, board reporting and data practice against the guidance, keep what works and agree actions with owners and dates.
3. 03
   Set direction through board policies.Approve the AI policy, risk appetite, decision rights and data principles, and agree what management reports, how often and to whom.
4. 04
   Embed the policies and keep the evidence.Assign accountable executives, train directors and managers, run the first reporting cycles and record the decisions they lead to.
5. 05
   Review independently and decide on certification.An internal audit or board evaluation tests whether oversight works; if assurance is required, extend into ISO/IEC 42001 and its accredited certification route.

Check the route before you sign. Nobody can issue an accredited ISO/IEC 38507 certificate, so treat any offer of one with caution. If a buyer or regulator wants certified evidence of AI governance, ask which certifiable standard is meant, usually ISO/IEC 42001, and verify the certification body's accreditation with an accreditation body recognised under the Global ACI arrangement. The certification buyer's checklist

Cost

How much does ISO 38507 implementation cost?

The effort depends far more on how AI is used than on headcount. A firm with a handful of AI features in bought-in software needs a lighter framework than a group whose products make automated decisions about customers. Every Sterling proposal shows each component and one all-inclusive proposal.

Timeline

How long does ISO 38507 implementation take?

Board calendars set the pace more than consulting effort does, because policies need approval and reporting needs at least one full cycle before anyone can say it works. As an estimate, a single organisation typically needs two to four months to reach a working framework; groups and heavy AI users take longer.

If an investor meeting, tender or regulatory date is driving the work, tell us at the start and we will plan backwards from it.

Your engagement

What your ISO 38507 engagement includes

Sterling applies the Sterling OS™ to board-level AI governance. In Design™ we guide your team while it does the work; in Drive™ we manage the work for you. You choose one of the two support levels, not both in sequence.

• Scope, gap analysis and plan

  An AI inventory, a gap analysis against the guidance and an action plan with owners and dates.

• Board AI policies

  AI policy, risk appetite, decision rights and data principles, drafted with your directors and legal advisers.

• Effivity ISO & GRC software

  The AI register, risks, actions and board reporting in Effivity, included with the engagement at no additional cost.

• Training for directors and managers

  Briefings for the board, internal auditor training as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Reporting and review

  A board reporting pack and an internal review of whether oversight works, with findings closed with evidence.

• Sustain™ and Automate™

  Sustain™ keeps policies and reporting current as AI use grows; Automate™ runs the framework in Effivity.

ISO/IEC 38507 has no certificate. Sterling does not certify, accredit, attest or validate; for ISO/IEC 42001, certification decisions rest with an independent, accredited certification body.

Often combined with

Standards organisations pair with ISO/IEC 38507

• EU AI ActEU AI Act compliance consulting: classify each AI system, document high-risk requirements and transparency duties, and prepare conformity assessment evidence.
• ISO/IEC 23894ISO 23894 AI risk management made practical: the ISO 31000-based guidance, its structure, no certificate, and how Sterling builds it, with a route to ISO 42001.
• ISO/IEC 42001ISO/IEC 42001 certification consulting for AI governance: risks and impacts assessed, treated and evidenced, then supported through the certification audit.
• ISO/IEC 42005ISO 42005 guidance on AI system impact assessment: what ISO/IEC 42005:2025 covers, its structure, how to put it into practice and how Sterling helps.
• ISO/IEC 42006ISO 42006 explained: the requirements for bodies that audit and certify ISO/IEC 42001 AI management systems, how accreditation works and what to check.
• ISO/IEC 5338ISO/IEC 5338 AI life cycle processes explained: the 2023 process groups, what they ask of AI teams, why there is no certificate and how Sterling helps.