1.1 Artificial Intelligence Concepts, Terminology & Taxonomy (ISO/IEC 22989 & 23053)
Key Takeaways
- ISO/IEC 22989:2022 defines an Artificial Intelligence System as an engineered system that generates outputs such as content, forecasts, recommendations, or decisions for a given set of human-defined objectives.
- ISO/IEC 23053:2022 establishes a standardized framework for machine learning using data analytics, structuring the ML lifecycle into data acquisition, preprocessing, feature engineering, model training, validation, deployment, and continuous monitoring.
- Machine learning models are fundamentally data-driven and probabilistic, contrasting with traditional software engineering which relies on deterministic, human-coded conditional logic.
- Systemic operational risks unique to AI include data drift (shifts in input feature distributions) and concept drift (shifts in the statistical relationship between features and target labels).
- Generative AI models and foundation models introduce non-deterministic outputs, requiring specialized governance controls around prompt engineering, hallucination risk, and training data provenance.
1.1 Artificial Intelligence Concepts, Terminology & Taxonomy (ISO/IEC 22989 & 23053)
Establishing a robust Artificial Intelligence Management System (AIMS) under ISO/IEC 42001:2023 requires a rigorous, standardized understanding of AI terminology, technical concepts, and architectural taxonomies. Without clear definitions, organizations risk misalignment between executive governance, legal compliance, risk assessment, and technical implementation. International standards ISO/IEC 22989:2022 (Artificial intelligence — Concepts and terminology) and ISO/IEC 23053:2022 (Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML)) form the foundational vocabulary and structural framework for all ISO/IEC AI standards.
Foundational Definitions and Core Terminology (ISO/IEC 22989)
ISO/IEC 22989 establishes the normative terminology used throughout the ISO/IEC 42001 ecosystem. A Lead Implementer must master these definitions to effectively scope an AIMS and communicate across multidisciplinary teams:
- Artificial Intelligence System (AI System): An engineered system that generates outputs such as content, forecasts, recommendations, or decisions for a given set of human-defined objectives. AI systems are designed to operate with varying levels of autonomy and adaptiveness.
- Autonomy: The degree to which an AI system can perform tasks and make decisions without human intervention.
- Adaptiveness: The capability of an AI system to learn from experience, operational data, or environmental feedback and adjust its internal parameters or behavior over time.
- Machine Learning (ML): A branch of AI that enables systems to automatically optimize performance metrics or infer patterns from data without being explicitly programmed with rule-based logic.
- Deep Learning (DL): A specialized subset of machine learning based on artificial neural networks with multiple hidden layers, capable of learning hierarchical representations from unstructured data (e.g., text, images, audio).
- Generative AI (GenAI): AI models specifically optimized to create novel synthetic content—such as text, images, video, audio, or software code—based on statistical patterns learned from vast training datasets.
- Foundation Models: Broadly trained, large-scale deep learning models (such as Large Language Models or Multimodal Models) trained on massive quantities of unlabeled data that can be adapted or fine-tuned to a wide range of downstream tasks.
- Expert Systems / Rule-Based AI: Early AI paradigms where domain expertise is hardcoded into explicitly engineered conditional logic rules (
IF-THENstructures) rather than inferred from data.
Machine Learning Taxonomy and Paradigms
ISO/IEC 22989 categorizes machine learning techniques according to their learning mechanics, supervisory signals, and operational objectives:
1. Supervised Learning
The algorithm is trained on a labeled dataset where input features ($X$) are paired with ground-truth target outputs ($Y$). The goal is to learn a mapping function $f(X) \rightarrow Y$. Primary tasks include classification (assigning discrete categories, such as fraud detection) and regression (predicting continuous numerical values, such as credit risk scores).
2. Unsupervised Learning
The algorithm processes unlabeled data to discover underlying structures, patterns, or groupings without explicit target guidance. Primary techniques include clustering (e.g., $k$-means for customer segmentation), dimensionality reduction (e.g., Principal Component Analysis), and anomaly detection (identifying statistical outliers in transaction logs).
3. Semi-Supervised Learning
A hybrid approach where the model trains on a small amount of labeled data combined with a large volume of unlabeled data, mitigating the high cost of manual data annotation.
4. Reinforcement Learning (RL)
An agent learns optimal decision-making strategies by interacting with an environment. The agent executes actions, receives state feedback, and earns positive rewards or negative penalties. The objective is to learn a policy function that maximizes cumulative rewards over time.
Traditional Software Engineering vs. AI/ML Engineering
A critical responsibility of the ISO/IEC 42001 Lead Implementer is educating enterprise leadership on why traditional Information Security Management Systems (such as ISO/IEC 27001) are necessary but insufficient for governing AI systems. The fundamental differences lie in system architecture, behavior, testing methodologies, and failure modes.
| Operational Dimension | Traditional Software Engineering | Machine Learning / AI Engineering |
|---|---|---|
| Primary Driver of Logic | Human developers writing explicit code. | Algorithms extracting statistical patterns from data. |
| System Behavior | Deterministic: Given input $A$, output $B$ is constant. | Probabilistic: Outputs represent statistical likelihoods. |
| Testing & Verification | Unit tests, functional tests, code coverage analysis. | Empirical statistical evaluation, cross-validation, drift monitoring. |
| Failure Modes | Syntax errors, logical bugs, buffer overflows. | Data bias, data drift, concept drift, adversarial evasion, hallucination. |
| Lifecycle Dynamics | Code updates occur through explicit commits and deployments. | Models degrade silently as underlying real-world data distributions change. |
| Explainability | High: Logic can be inspected directly via code execution paths. | Variable/Low: Deep neural networks operate as non-transparent "black boxes." |
The ISO/IEC 23053 Machine Learning Lifecycle Framework
ISO/IEC 23053 details the standardized pipeline through which data-driven machine learning models are designed, built, and sustained. Understanding this lifecycle is vital for embedding ISO/IEC 42001 Annex A controls at each stage:
- Business & Problem Understanding: Defining clear business objectives, establishing feasibility, and specifying ethical/regulatory constraints.
- Data Acquisition & Collection: Gathering relevant raw data from internal databases, sensors, third-party vendors, or web scrapes.
- Data Preprocessing & Data Governance: Cleaning, deduplicating, anonymizing, handling missing values, and validating data provenance.
- Feature Engineering & Selection: Transforming raw data variables into informative representations (features) that optimize model training.
- Model Training & Tuning: Selecting model architectures (e.g., Random Forests, Transformers) and optimizing hyper-parameters.
- Model Evaluation & Validation: Assessing model performance against holdout test datasets using rigorous statistical metrics (Accuracy, Precision, Recall, F1-Score, ROC-AUC, Mean Squared Error).
- Model Deployment: Packaging and serving the model via REST APIs, microservices, or edge computing hardware.
- Operation, Monitoring & Continuous Learning: Tracking operational performance, monitoring input distributions for data drift, and detecting changes in target relationships (concept drift).
Practical Implementation Scenario
Scenario: Apex Financial, a retail banking institution, is replacing its legacy rule-based loan approval system with a deep learning ensemble model to improve approval speed and accuracy. The Chief Risk Officer (CRO) assumes that existing ISO/IEC 27001 IT controls for software deployment are sufficient.
Lead Implementer Guidance: The Lead Implementer conducts a gap assessment using ISO/IEC 22989 and 23053 concepts. The Implementer demonstrates to executive leadership that traditional IT controls fail to address AI-specific risks. Specifically, while ISO 27001 secures the server host and API endpoint, it does not evaluate whether the training dataset contains historical demographic bias, whether concept drift will degrade credit scoring accuracy within 6 months, or whether the model can provide legally required adverse action explanations. The organization must establish an ISO/IEC 42001 AIMS to govern data quality, algorithmic transparency, and model lifecycle monitoring alongside traditional IT security.
According to ISO/IEC 22989:2022, what is the primary technical distinction between an Artificial Intelligence system and a traditional software application?
During the operational phase of a deployed machine learning model, the input feature distribution changes significantly due to macro-economic shifts, causing model accuracy to degrade while the target definition remains constant. In ISO/IEC 23053 terminology, what is this phenomenon called?
Which machine learning paradigm involves an autonomous agent executing actions within an environment, learning optimal decision strategies through state feedback, rewards, and penalties?