2.1.4. Global AI Frameworks and Unified Vocabulary
💡 First Principle: Organizations increasingly buy, build, and audit AI across borders and supply chains. International standards give all parties the same definitions and the same expectations for how AI should be managed, so that "we govern AI responsibly" can be verified rather than merely claimed.
The exam guide names two ISO/IEC standards. A third, closely related standard explains the vocabulary they rely on. You need to know what each one is for, not its clauses.
| Standard | What it is | Why a business leader cares |
|---|---|---|
| ISO/IEC 22989 (2022) | AI concepts and terminology | Defines the shared vocabulary (AI system, ML model, training, stakeholders) that other AI standards use |
| ISO/IEC 23053 (2022) | A framework for describing AI systems that use machine learning: their components and functions within the AI ecosystem | Gives business, technical, and vendor teams a common way to describe what an ML-based system consists of and how its parts fit together |
| ISO/IEC 42001 (2023) | A management system standard for AI (AIMS): requirements for establishing, implementing, maintaining, and continually improving how an organization governs AI | Certifiable by an accredited auditor; demonstrates to customers, partners, and regulators that AI governance is systematic, with policies, roles, risk assessment, and controls |
ISO/IEC 42001 follows the same management-system pattern as ISO/IEC 27001 for information security: set policy and objectives, assess risks and impacts, apply controls, monitor, audit, and improve (Plan-Do-Check-Act). It does not tell you which algorithm to use or how to build a model. It tells you how to run the organization that uses AI. AWS has itself achieved ISO/IEC 42001 certification for a range of its AI services, which is one input (not a substitute) for a customer's own governance under the shared responsibility model.
Other frameworks you may meet in scenarios include the NIST AI Risk Management Framework (voluntary US guidance organized around Govern, Map, Measure, Manage) and regulations such as the EU AI Act. Phase 4 covers how these shape governance and risk classification. For Domain 1, the point is literacy: knowing that a standard exists to align vocabulary (22989, 23053) differs from one that defines a certifiable governance system (42001).
⚠️ Exam Trap: ISO/IEC 42001 is a management system standard for how an organization governs AI, not a technical specification for building models. If a scenario asks how to demonstrate systematic, auditable AI governance to customers or regulators, 42001 certification fits. If it asks for a common vocabulary or a reference description of ML system components, think 22989 or 23053.
Reflection Question: A multinational's European customers ask for evidence that its AI use is governed systematically. Its engineering team proposes publishing model architecture diagrams. Why does that not answer the question, and what would?
