ISO/IEC 5338 · AI system life cycle processes
ISO/IEC 5338 AI life cycle processes and requirements, from first idea to retirement.
ISO/IEC 5338 describes how an AI system should be conceived, built or acquired, validated, run, maintained and eventually retired, as a set of defined processes. Sterling's expert and experienced consultants map those processes onto the way your teams already deliver technology, close the gaps with your people and leave you with records that show the life cycle is under control, in 60+ countries. There is no certificate for this standard. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced AI governance consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify, and ISO/IEC 5338 carries no certificate
8,100+ client engagements in 60+ countries.
AI governance client experience
What it is
What is ISO/IEC 5338 and what is it used for?
ISO/IEC 5338 is the international standard that sets out the life cycle processes for AI systems. It was prepared by the joint ISO and IEC committee on artificial intelligence, JTC 1/SC 42, and covers systems based on machine learning as well as heuristic systems. It starts from the established systems and software life cycle standards, ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207, and adapts them with AI-specific additions drawn from ISO/IEC 22989 and ISO/IEC 23053.
The practical value is continuity. A conventional application behaves the same way until someone changes its code; a model can drift as the data it meets in production moves away from the data it learned from. ISO/IEC 5338 gives engineering, data and product teams one shared set of processes for defining, controlling, managing, executing and improving a system through every stage, whether you build it yourself or acquire it from a supplier. Governance teams use it to link a responsible-AI policy to daily engineering work.
Current edition. ISO/IEC 5338:2023, the first edition, was published on 20 December 2023. ISO shows no amendment and no revision in progress as at September 2026, so there is no transition to plan. The standard is guidance on processes, not a set of certifiable management system requirements.
Who it is for
Who needs ISO/IEC 5338?
Nobody is issued an ISO/IEC 5338 certificate, so the reasons to adopt it are about control and credibility. Organisations usually come to Sterling from one of four directions:
- A customer wants to see how your AI is built. Questionnaires about training data, validation and monitoring get consistent answers from a life cycle defined against an international standard.
- A tender asks about AI development practice. Buyers want proof that models are verified before release and watched afterwards; mapped processes and records give the bid team that proof.
- Regulators and auditors are asking questions. Where AI supports decisions about people, money or safety, supervisors expect evidence of disciplined development and oversight. ISO/IEC 5338 gives that evidence a recognised structure, alongside the advice of your legal team.
- Group companies build AI in different ways. A common process set lets subsidiaries compare and reuse practice without forcing one toolchain on everyone.
The aim is a life cycle your own people run and can explain. The benefit depends on adoption and ownership, not on the standard alone.
Requirements
What are the main ISO/IEC 5338 requirements?
ISO/IEC 5338 first explains its key concepts, including an AI system life cycle model, and then groups its processes into four families familiar to anyone who knows the systems and software standards. Each process is classed as generic (kept as those standards define it), modified, or specific to AI. The list is a plain-language summary; the gap assessment works from the standard itself.
- Key concepts: the AI system concepts, the life cycle model with its stages, and how processes are described and tailored.
- Agreement processes: acquisition and supply, so that responsibilities are clear when an AI system or its components come from, or go to, another party.
- Organisational project-enabling processes: life cycle model management, infrastructure, portfolio, human resources, quality management and knowledge management that every AI project draws on.
- Technical management processes: planning, assessment and control, decisions, risk, configuration, information, measurement and quality assurance across the project.
- Technical processes: from business or mission analysis and requirements through architecture, design, implementation, integration, verification, transition, validation, operation, maintenance and disposal.
- Processes that reflect how AI learns: the technical group also includes knowledge acquisition, AI data engineering and continuous validation, which address data and model behaviour over time.
- Use-case observations: an informative annex draws lessons from the AI use cases collected in ISO/IEC TR 24030.
What does useful ISO/IEC 5338 evidence look like?
A register of the AI systems in scope with an accountable owner and a life cycle stage for each; requirements that name the performance and behaviour the business expects; data provenance and preparation records; verification and validation results tied to a release; a monitoring plan with thresholds that trigger retraining or withdrawal; supplier agreements for acquired models; and a decision log for retirement. We keep only records the work genuinely produces, held in Effivity from the start.
Implementation route
How do you implement ISO/IEC 5338?
Because there is no certification audit at the end, the route is about adoption and proof: processes defined, used on real systems and reviewed. Sterling guides the work; your teams own the processes.
- 01Choose the AI systems and stages in scope.List the systems you build, supply or acquire, their current stage and the teams, data and suppliers behind them.
- 02Gap analysis: compare current practice with the process set.Review how each group of processes works today, keep what is effective and agree the missing pieces, owners and dates.
- 03Tailor and define the processes.Fit the life cycle model to your delivery method, then write lean procedures for data engineering, validation, release and monitoring.
- 04Run them on live systems and keep the records.Apply the processes to at least one system through a release and into operation, so the evidence reflects real work.
- 05Review, improve and decide on certification.An internal review tests adoption; findings are closed with evidence, and you decide whether to seek ISO/IEC 42001 certification.
Check the route before you sign. Any offer of an "ISO/IEC 5338 certificate" should be declined: no accredited certification exists for this standard. If a customer needs a certificate, the recognised option is ISO/IEC 42001, audited by a certification body whose accreditation comes from a body within the Global ACI arrangement; confirm it on that accreditation body's public register. The certification buyer's checklist
Cost
How much does ISO/IEC 5338 implementation cost?
The effort depends far more on your AI estate than on your headcount. One team with a single model has a different job from a group running many models across suppliers. Every proposal shows its components and states everything that is included.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | AI systems and stages in scope, existing engineering discipline, teams involved, and Design™ or Drive™ |
| Related certification, if chosen | Only if you also seek ISO/IEC 42001: the certification body's audit days, locations and travel |
| Internal resources | Time from product, data, engineering, risk and procurement staff, and changes to release practice |
| Software and learning | Included in a Sterling engagement: Effivity and Sterling Academy access, confirmed in the proposal |
| Continued support | Reviews as models are retrained or replaced, and extension to further systems under Sustain™ |
What moves the price
- How many AI systems are in scope, and how many are acquired rather than built
- Whether a documented software or systems life cycle already exists
- The maturity of data management and model monitoring
- Deadlines set by customers, tenders or internal governance
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Any certification-body fees for a related standard identified separately
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones linked to deliverables
- One all-inclusive proposal, agreed before work begins
Timeline
How long does ISO/IEC 5338 implementation take?
As an estimate, aligning an organisation's AI life cycle with ISO/IEC 5338 typically takes three to six months. The deciding factor is time in use: the processes must run through at least one release and a period of monitoring before the records mean anything.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to system owners, data teams, suppliers and existing engineering records |
| Process design | How far current delivery methods need to change, and approval times |
| Use on live systems | Release cycles, retraining schedules and the monitoring period needed to show control |
| Review and next step | Internal review, closure of findings and any decision on ISO/IEC 42001 certification |
If a customer or tender date is driving the work, tell us on day one. We will say what is realistic and which decisions need to be made early.
Your engagement
What your ISO/IEC 5338 engagement includes
Sterling delivers the work through Sterling OS™. Design™ is guided support in which your teams do the writing with our review; Drive™ is managed support in which our consultants carry the build. You choose one of the two, not both in sequence. Sustain™ keeps the processes current afterwards, and Automate™ is Effivity, where the records live. Sterling does not certify, and no one certifies to ISO/IEC 5338.
Scope, gap analysis and plan
AI systems, stages, owners and dates agreed before any process is written.
Tailored life cycle processes
Built with your engineers and data teams, sized to how you actually release.
Effivity ISO & GRC software
Process records and registers in Effivity, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your reviewers, as applicable to your standard, and preferential Sterling Academy access with complimentary awareness training for your people as part of the engagement.
Internal review
Adoption tested on live systems, with findings closed and evidenced.
Route to ISO/IEC 42001
If certification is wanted, the processes feed an AI management system ready for an accredited audit.
ISO/IEC 5338 carries no certificate; certification decisions for any related standard remain with the independent certification body.
Often combined with
Standards organisations pair with ISO/IEC 5338
- EU AI ActEU AI Act compliance consulting: classify each AI system, document high-risk requirements and transparency duties, and prepare conformity assessment evidence.
- ISO/IEC 23894ISO 23894 AI risk management made practical: the ISO 31000-based guidance, its structure, no certificate, and how Sterling builds it, with a route to ISO 42001.
- ISO/IEC 38507ISO 38507 AI governance and requirements explained: the 2022 guidance for boards on AI use, why no certificate exists and how Sterling puts it into practice.
- ISO/IEC 42001ISO/IEC 42001 certification consulting for AI governance: risks and impacts assessed, treated and evidenced, then supported through the certification audit.
- ISO/IEC 42005ISO 42005 guidance on AI system impact assessment: what ISO/IEC 42005:2025 covers, its structure, how to put it into practice and how Sterling helps.
- ISO/IEC 42006ISO 42006 explained: the requirements for bodies that audit and certify ISO/IEC 42001 AI management systems, how accreditation works and what to check.
Effivity · ISO and GRC software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO/IEC 5338:2023.
Every Sterling ISO/IEC 5338 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so documents, risks, audits, nonconformities, supplier evaluations, training records and management review sit together with the forms your AI teams use for releases and monitoring. The life cycle then leaves a trail as work happens, not afterwards. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
AI system register and scope
Each system in scope recorded once, with its owner, purpose, stage and the teams involved, so everyone works from the same list.
Suppliers of models and data
Supplier evaluations and the responsibilities agreed for acquired models, datasets and platforms, reviewed on a schedule.
Competence and documented processes
Training records for engineers and reviewers, linked to Sterling Academy, and controlled procedures with versions and approvals.
Risks and decisions
A risk register with owners, treatments and review dates, and decisions recorded where the project team can find them.
Measures that matter
Performance and monitoring indicators on dashboards, so drift and missed thresholds surface before a customer notices.
Release and validation records
Custom forms capture requirements, verification and validation results and release approval for each version.
Issues and corrective action
Incidents and model issues raised, investigated and closed with cause and evidence that the fix worked.
Internal audit and review
Audit programmes, findings and management review records in one place, ready for a customer's questions or a later ISO/IEC 42001 audit.
What this means when a customer asks
A customer or auditor asking how a model was validated, who approved the release and what happens when it drifts gets a screen with dates, owners and attachments, not a hunt through shared drives. Sustain™ continues in the same workspace, so the answers stay current as systems change.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing documents and registers migrated, not retyped
- Admin and user training for your team
- Modules for QMS, ISMS and more when you integrate other standards
Sterling Academy · AI governance e-learning
Train the people who build, approve and run your AI.
Sterling Academy provides e-learning with video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients receive preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness for everyone involved in your AI systems, with training records kept as evidence
- Internal auditor training for your reviewers, as applicable to your standard, as part of the engagement
- Progress reporting by team, and new starters trained as they join
Keep exploring
Explore more about ISO/IEC 5338
ISO/IEC 5338 resources
Services for ISO/IEC 5338
Why Sterling
Why choose Sterling for ISO/IEC 5338?
AI life cycle work sits between engineering and governance, and it fails when either side is left out. Sterling works with both, so the processes read well to a risk committee and still fit the way your teams ship.
60+ countries since 2003
Management systems delivered for clients across regions, with one engagement team accountable wherever your AI teams sit.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any certification-body fees shown separately.
Processes engineers will follow
Short procedures tied to real release and monitoring steps, not a parallel paperwork track.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003 and who bring that discipline to AI governance.
The Sterling Promise
What our ISO/IEC 5338 success guarantee means
We stay with you until your agreed ISO/IEC 5338 outcome is achieved, supporting process design, adoption on live systems and the closure of review findings. Included software and employee learning turn the investment into lasting capability.
The engagement identifies the standard, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed processes into use. ISO/IEC 5338 carries no certificate; for any related standard, the independent certification body assesses conformity and retains its decision. Our commitment concerns the agreed support, not a promise of every future tender award or error-free delivery.
FAQs
Frequently asked questions about ISO/IEC 5338
Is ISO/IEC 5338 mandatory?
No. Like other ISO standards it is voluntary. It becomes binding only where a contract, a customer requirement or a sector rule refers to it, so read the exact wording that applies to you, with your legal advisers where needed.
What is the difference between ISO/IEC 5338 and ISO/IEC 42001?
ISO/IEC 5338 describes the processes for engineering and running an AI system; ISO/IEC 42001 sets certifiable requirements for the management system that governs AI across the organisation. Many clients use the first to shape life cycle practice and the second to prove governance to customers.
Does ISO/IEC 5338 apply if we acquire AI rather than build it?
Yes. The standard states that its processes can be used when developing or acquiring AI systems, and its agreement processes cover acquisition and supply. For a purchased model, the focus shifts to supplier requirements, acceptance, monitoring and exit.
Do we need ISO/IEC/IEEE 15288 or 12207 in place first?
No, but they help. ISO/IEC 5338 is based on those two standards, so teams that already follow them will recognise much of the structure and can extend their existing life cycle rather than write a new one.
How can we show a customer we follow ISO/IEC 5338 without a certificate?
Share an evidence pack: your tailored life cycle, a register of systems in scope and sample validation, release and monitoring records. Where the customer insists on a certificate, ISO/IEC 42001 certification from an accredited body is the recognised answer.
Keep exploring
More on ISO/IEC 5338 and related standards
More in AI governance & digital trust
Talk to a consultant
Bring your AI life cycle in line with ISO/IEC 5338.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice