itSMF Switzerland - Blog #GRC

The governance of data according to the ISO/IEC 38505-1 standard

Wed, 01 Oct 2025 07:00:00 +0200

Reading time: ~ 2 min.

The ISO/IEC 38505-1 standard: the reference point for data governance

The ISO/IEC 38505-1 standard on «Information technology — Governance of IT — Governance of data» provides effective guidelines to apply the ICT governance principles set by the ISO 38500 and ISO 38501 standards to the data governance.

We should keep in mind that the ISO/IEC 38505-1:2017 standard is applicable to every kind of organizations, such as companies (private or public ownership), government (agencies, departments, bureaus and other public bodies) and nonprofit organizations.

Both small and large organizations can take advantage of the application of ISO/IEC 38505-1 standard, no matters how big can be the dependence on data of their activities. The guidance provided by this standard can be useful to professionals as:

executive managements
external specialists (business or technical): legal, accounting, retail, industrial,...
external and internal service providers (consultants too)
auditors

Please be aware that the ISO/IEC 38505-1 provides a guidance to the governance of data, whereas

the guidance about the implementation arrangement for the effective governance of IT is available on the ISO/IEC/TS 38501 documentation.

The ISO/IEC 38505-1 standard structure

The ISO/IEC 38505-1 standard has 11 main chapters. This is an overview on the structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions

Chapter 4: good governance of data

4.1 benefits of good governance of data
4.2 responsibilities of the governing body
4.3 governing body and oversight mechanisms

Chapter 5: principles, model and aspects for good governance of data
Chapter 6: data accountability

6.1 General
6.2 Collect
6.3 Store
6.4 Report
6.5 Decide
6.6 Distribute
6.7 Dispose

Chapter 7: guidance for the governance of data – principles

7.1 General
7.2 Principle 1 – responsibility
7.3 Principle 2 – strategy
7.4 Principle 3 – acquisition
7.5 Principle 4 – performance
7.6 Principle 5 – conformance
7.7 Principle 6 – human behaviour

Chapter 8: guidance for the governance of data – model

8.1 Applying the model
8.2 Internal requirements
8.3 External requirements
8.4 Evaluate
8.5 Direct
8.6 Monitor

Chapter 9: guidance for the governance of data – data-specific aspects

9.1 General
9.2 Value
9.3 Risk
9.4 Contraints

Chapter 10: application of the data accountability map

Our infographic on ISO/IEC 38505-1 standard

To better figure out the «big picture» about the ISO 38505-1 standard, take a look at our infographic:

ISO/IEC 38505-1: the correlations between standards and references with regulations

If we consider the ISO/IEC 38505-1:2017 standard, we find direct and natural correlations with the following standards:

ISO 20000-1 on «Information technology – service management»
ISO 27001 on «Information security, cybersecurity and privacy protection — Information security management systems — Requirements»

Among the references with the regulations or laws, we find several them in particular on protection of personal data, such as: European GDPR, Swiss FAPD (known also as LPD and DSG).

If you want to keep you up-to-date with the most recent news on this topic, don't forget to subscribe to our newsletter: you will get a monthly update with the most relevant and valuable content from our experts!

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The internal investigations of organizations according to the ISO 37008 standard

Wed, 03 Sep 2025 07:00:00 +0200

Reading time: ~ 3 min.

The management of internal investigations of organizations according to the ISO/TS 37008 standard

For internal investigation we understand the professional fact-finding process lead by (or for, if this process leading is transfered outside) an organization to establish facts in relation to supposed or suspicious wrongdoing, misconduct or noncompliance.

The internal investigation in indeed an integral part of organizational management and the standard ISO/TS 37008:2023 on «Internal investigations of organizations – Guidance» provides support for its implementation.

The internal investigation of organizations can examine cases such as bribery, fraudulent activities, harassment, violence or discrimination (just to mention some typical situations we can apply the standard to manage the process of fact-finding).

We can have different reasons why we need to lead an internal investigation, such as:

civil actions (liability, responsibility,...);
whistleblowing reports (discern between substantiated or unsubstantiated allegation);
external investigations led by regulators (need for reporting);
decision-making process (requirements set by laws, regulations, codes, policies,...).

We have to keep in mind that internal investigation is part of a compliance management system of an organization.

The ISO/TS 37008 standard structure

The ISO/TS 37008 standard has 11 main chapters and an «ANNEX A». This is an overview on the structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions

Chapter 4: Principles

4.1 Independent
4.2 Confidential
4.3 Competent and professional
4.4 Objective and impartial
4.5 Legal and lawful

Chapter 5: Support of internal investigations

5.1 Resources
5.2 Leadership and commitment

Chapter 6: Establishment of investigation policy or procedure
Chapter 7: Safety and protection measures

7.1 Preserving and securing evidence
7.2 Protection of and support to personnel involved in investigations
7.3 Anti-retaliation
7.4 Safeguarding

Chapter 8: Investigative process

8.1 Investigation team
8.2 Preliminary assessment
8.3 Determining the scope of the investigation
8.4 Investigation planning
8.5 Maintaining confidentiality
8.6 Liability caution to deter disclosure
8.7 No interference
8.8 Evidence
8.9 Interviews
8.10 Finalization process
8.11 Investigation report

Chapter 9: Potential remedial measures or improvements

9.1 Proposal of remedial measures and improvements
9.2 Interim remedial measures
9.3 A final plan for post-investigation remedial measures
9.4 Proportionality of remediation and improvement measures
9.5 Monitoring and enforcement of remedial measures

Chapter 10: Interaction with stakeholders

10.1 General
10.2 Planning
10.3 Measures for the communication process
10.4 Effective communication channels
10.5 Government and regulator communication
10.6 Self-disclosure to the authorities

Chapter 11: Disciplinary actions

Annex A Guidance on the use of this document (10

ISO 37008 standard: correlations between other standards and regulations

The ISO/TS 37008 standard is logically downstream of whistleblowing reports (we can consider for example the Italian Legislative Decree 24/2023 on whistleblowing).

This standard is also useful in correlation with:

ISO 37002:2021«Whistleblowing management systems – Guidelines»;
ISO 37001:2016«Anti-bribery management systems standard».

ISO 37008 provides support also in the implementation of the organization and management models (OMM) set by the Italian Legislative Decree 231/01 (corporate criminal Liability).

Our infographic on ISO/TS 37008 standard

To better figure out the «big picture» about the ISO/TS 37008 standard, take a look at our infographic:

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

DORA Regulation and ISO Management Systems: a GRC approach

Wed, 06 Aug 2025 07:00:00 +0200

Reading time: ~ 2 min.

The Digital Operation Resilience Act (DORA) Regulation

The Regulation (EU) 2022/2554 of the European Parliament and the Council of 14 December 2022 on digital operational resilience for the financial sector entered into force on 16 January 2023 and it applies to EU financial service providers.

The Digital Operation Resilience Act (commonly known as DORA) amends all these regulations:

(EC) N. 1060/2009, commonly known as «Credit Rating Agencies»;
(EU) N. 648/2012, commonly known as «EMIR», OTC derivatives;
(EU) N. 600/2014, commonly known as «MIFIR», Markets in Financial Instruments;
(EU) N. 909/2014, commonly known as «CSDR»;
(EU) 2016/1011, commonly known as «Benchmark Regulation».

The requirements of digital resilience and security set by DORA

The Digital Operational Resilience Act (DORA) defines a set of requirements to ensure both digital resilience and security especially in the following chapters:

📘 I. General Provisions
📘 II. ICT Risk Management
📘 III. ICT Related Incident Management Process
📘 IV. Digital operational resilience test
📘 V. Managing of ICT third party risk
📘 VI. Information sharing arrengement

To manage these requirements, we can adopt – as usual – our GRC approach. These are the relevant ISO standards we can rely on:

ISO 38500 (Governance)
ISO 31000 (Risk Management)
ISO 37301 (Compliance)

The GRC approach provides a useful basis for addressing and integrating the main aspects of:

ISO 22301 (Resilience and business continuity)
ISO 27001 (Information security)
ISO 20000-1 (ICT services; such as: asset and configuration, management, threats and vulnerabilities)
ISO 27035 (incident and problem management)
backup and disaster recovery, etc.

Our infographic on the applicable ISO standards

To better figure out the «big picture» about the DORA regulation and the ISO Management Systems according to the suggested GRC approach, take a look at this infographic:

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Software as a Medical Device (SaaMD): artificial intelligence and innovation

Wed, 23 Jul 2025 07:00:00 +0200

Reading time: ~ 2 min.

Software as a Medical Device (SaaMD): how to manage the requirements set by regulations?

We already had a look at Software as a Medical Device on our previous posts – here with a point of vue about data protection – and today we focus once again on SaaMD considering in particular innovation management and AI implementation related to this industry.

The production of medical devices can take advantage of the incredibile innovation brought by technology, but needs also to manage this development according to solid guidelines (as the ones delineated in ISO 56002 standard that can be applied to).

More and more software (SW) that are classified as medical devices pursuant to the EU MDR 2017/745 – see also the «MDCG 2019-11 Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 - MDR and Regulation (EU) 2017/746 - IVDR» – embed innovative solutions based on Artificial Intelligence.

The AI compliance with EU 2024/1689 regulation

Hence the need to manage compliance with the requirements set by the Regulation EU 24/1689 (commonly known as «AI Act») throughout the SW development cycle according to the IEC 62304: 2006 standard «Software for medical devices - Software life cycle processes »

The implementation of an Artificial Intelligence Management System according to the ISO 42001 standard supports effectively the development of innovative AI-based solutions also in the medical device industry; it can be also integrated with the following management systems:

ISO 13485 standard on «quality in the medical device sector»
ISO 20000-1 standard on «IT Services»
ISO 27001 standard on «Information security and data protection requirements» (GDPR).

Our infographic on SaaMD related regulations and applicable ISO standards

To better figure out the «big picture» about the requirements set by regulations on SaaMD and the correlated ISO standards, take a look at our infographic:

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The AI risk management according to the ISO/IEC 23894 standard

Wed, 25 Jun 2025 07:00:00 +0200

Reading time: ~ 3 min.

ISO/IEC 23894 standard: the risk management of artificial intelligence (AI)

The ISO/IEC 23894:2023 standard on «Information technology — Artificial intelligence — Guidance on risk management» provides an effective guidance for risk management related to Artificial Intelligence (AI) for all kind of organizations that:

develop
produce
deploy
use

AI-based products, systems or even services.

This standard is useful also to help organizations to integrate risk management into their AI-related activities and functions. It provides a description of the processes needed for the effective implementation and integration of AI risk management.

The ISO/IEC 23894:2023 standard structure

The ISO/IEC 23894:2023 standard has 6 main chapters and 3 «ANNEX» (A, B and C). This is an overview on its structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions

Chapter 4: principles of AI risk management
Chapter 5: framework

5.1 General
5.2 Leadership
5.3 Integration
5.4 Design
5.5 Implementation
5.6 Evaluation
5.7 Improvement

Chapter 6: Risk management process

6.1 General
6.2 Communication and consultation
6.3 Scope, context and criteria
6.4 Risk assessment
6.5 Risk treatment
6.6 Monitoring and review
6.7 Recording and reporting

Annex A (information) common AI-related objectives
Annex B (information) common AI-related risk sources
Annex C (information) Risk management and AI System life cycle; it provides an example mapping between the risk management processes and an AI system life cycle.

Our infographic on ISO/IEC 23894:2023 standard

To better figure out the «big picture» on the ISO 23894 standard, take a look at our infographic:

The ISO 23894 standard and the main references

The ISO 23894 standard is not only referred to by ISO 31000:2018. We find references to this guidance also on ISO 42001 standard on «Management Systems for Artificial Intelligence»

If we take a look at the EU Regulation 2024/1689 (known as «EU Artificial Intelligence Act) we find some correlations between it and the ISO 23894 standard.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Resilience and crisis management according to the ISO 22361 standard

Wed, 04 Jun 2025 12:13:52 +0200

Reading time: ~ 3 min.

ISO 22361 standard: the resilience and crisis management

The ISO 22361:2022 standard on «Security and resilience – Crisis management – Guidelines» provides an effective guidance for every kind of organizations aside from their type, size or industry to improve their crisis management capability.

This document is useful not only to plan, but also to set, keep up-to-date and enhance the strategic crisis management ability in every organization. It helps also to improve the capability to identify and manage crisis.

The ISO 22361 standard is relevant for the top management (strategic responsabilities) and useful for everyone who operates under the direction of top management. The guidance has several relationships and interdepencies with other topics.

In particular, the application of ISO 22361 can be suggested by ISO 22301:2019 standard on «Security and resilience – Business continuity management systems requirements».

This document defines the requirements for a business continuity management system, remembering that crisis management is very important.

The ISO 22361:2022 standard structure

The ISO 22361:2022 helps to design and develop the crisis management capability in organizations, setting out the principles and practises needed.

Organizations have to provide committed leadership, structures, supportive culture and competent personnel to enhance their crisis management capability. To make effective their approach to crisis management, organizations should apply a set of principles that determine the development of a crisis management framework.

The standard outlines them into the following main clauses:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions
Chapter 4: crisis management – context, core concepts, principles
Chapter 5: building a crisis management capabilities (with crisis management framework and crisis management process focus)
Chapter 6: crisis leadership
Chapter 7: strategic crisis decision making (challenges and complexities)
Chapter 8: crisis communication (guidelines from strategy, management of relationships and reputation, consistency of message, …)
Chapter 9: training, validation and learning from crises.

Our infographic on ISO 22361:2022 standard

To better figure out the «big picture» on ISO 22361 standard, take a look at our infographic:

ISO 22361 standard and its main references

The ISO 22361 standard not only provides an effective guidance on «Security and resilience – Crisis management»: it can be used to in the context of management systems for information security (ISO 27001 standard) and for IT services (ISO 20000-1 standard).

If we extend our point of view on ISO 22361 to other regulations, we find many references in the following:

📘 European Directive NIS 2 cybersecurity
📘 European DORA regulation (Digital Operational Resilience Act) for the finance sector
📘 Bank of Italy Circular 285 for resilience requirements
📘 Circular 01/2023 from FINMA (Switzerland) for resilience requirements

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The information security risk management according to the ISO 27005 standard

Tue, 15 Apr 2025 09:43:13 +0200

Reading time: ~ 2 min.

ISO 27005 standard: the risk management of the information security

The ISO/IEC 27005:2022 standard on «Information security, cybersecurity and privacy protection — Guidance on managing information security risks» provides a useful guidance for all kind of organizations (no matter which type, size or industry).

ISO 27005 is useful for all the organizations that have already adopted an Information Security Management System according to the ISO 27001 standard to evaluate (assessment) and treat the information security risks.

If you want to have an overview on ISO/IEC 27001 Information Security Management System, check out our previous post. in the next lines, we're going to have a look at the 27005 standard structure.

The ISO/IEC 27005 standard structure

The ISO/IEC 27005 standard has 10 main chapters and an «ANNEX A». This is an overview on the structure:

Chapter 1: scope
Chapter 2: normative reference
Chapter 3: terms and definitions; with focus on:

3.1 «terms related to information security risk»
3.2 «terms related to information security risk management».

Chapter 4: structure of the document
Chapter 5: information security risk management; with focus on:

5.1 «information security risk management process»
5.2 «information security risk management cycles»

Chapter 6: Context establishment; with focus on:

6.1 Organizational considerations
6.2 Identifying basi requirements of interested parties
6.3 applying risk assessment
6.4 establishing and maintaining information security risk criteria

6.4.1 general
6.4.2 risk acceptance criteria
6.4.3 criteria for performing information security risk assessments

6.5 choosing an appropriate method

Chapter 7 Information security risk assessment process

7.1 general
7.2 identifying information security risks

7.2.1 identifying and describing information security risks
7.2.2 identifying risk owners

7.3 analysing information security risks

7.3.1 general
7.3.2 assessing potential consequences
7.3.3 assessing likelihood
7.3.4 determining the levels of risk

7.4 evaluating the information security risks

7.4.1 Comparing the results of risk analysis with the risk criteria
7.4.2 Prioritizing the analysed risks for risk treatment

Chapter 8 Information security risk treatment process

8.1 general
8.2 selecting appropriate information security risk treatment option
8.3 determining all controls that are necessary to implement the information security
risk treatment options
8.4 comparing the controls determined with those in ISO/IEC 27001:2022, Annex A
8.5 producing a statement of applicability
8.6 information security risk treatment plan

8.6.1 formulation of the risk treatment plan
8.6.2 approval by risk owners
8.6.3 acceptance of the residual information security risks

Chapter 9 Operation

9.1. performing information security risk assessment process
9.2 performing information security risk treatment process

Chapter 10 leveraging related ISMS processes

10.1 context of the organization
10.2 leadership and commitment
10.3 communication and consultation
10.4 documented information

10.4.1 general
10.4.2 documented information about processes
10.4.3 documented inforrmation about results

10.5 monitoring and review

10.5.1 general
10.5.2 monitoring and reviewing factors influencing risks

10.6 management review
10.7 corrective action
10.8 continual improvement

Annex A Examples of techniques in support of the risk assessment process

Our infographic on ISO/IEC 27005:2022 standard

To better figure out the «big picture» about the ISO 27005 standard, take a look at our infographic:

The ISO 27005:2022 is indeed a useful supplementation of the ISO 31000:2018 standard on «risk management – guidelines», as it applies the guidance provided by the second one to the specific topic of the information security risks.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The management systems for artificial intelligence ISO 42001:2023 and risk treatment according the Annex A

Wed, 19 Mar 2025 07:00:00 +0100

Reading time: ~ 2 min.

The management systems for AI and risk treatment: the ISO 42001 standard

In our previous post, we took a look at the ISO 42001:2023 standard focusing on the tools that organizations can use to implement security, protection, equity, transparency and data quality for AI based products or services.

Today we're going to consider in particular the «Annex A» of the latest version of the ISO standard on management systems for AI: the document reports a series of control objectives and operational controls that as an organization we can apply to address risks.

The ISO 42001 standard and the Annex A: control objectives and operational controls

On the ISO/IEC 42001:2023 standard «ANNEX A» we have a series of controls objectives and operational controls useful to support an organization that needs to manage and mitigate AI systems related risks (risk treatment and management).

This is the structure of the Annex A:

A.2 «Policies related to AI»
A.3 «Internal Organization»
A.4 «Resources for AI Systems»
A.5 «Assessing Impact of AI Systems»
A.6 «AI System Life Cycle»
A.7 «Data for AI System»
A.8 «Information for parties interested in AI systems»
A.9 «Use of AI systems»
A.10 «Third parties and customer relationships».

In the nex lines, let's have a quick overview on the controls, one by one.

Annex A, Control A.2 «Policies related to AI»

According to the ISO 42001 standard control A.2, the policy for AI systems development and use is the pillar on the approach that an organization can adopt for AI governance.

Annex A, Control A.3 «Internal organization»

The control A.3 is focused on the requirement for an organization to define and allocate teams or professionals (role and responsability) in charge of the oversight of every aspects of AI system management.

Annex A, Control A.4 «Resources for AI systems»

The control A.4 sets the need to identify and document every AI system essential resource, such as data, tools, computing resources and team expertise.

Annex A, Control A.5 «Assessing impact of AI systems»

The control A.5 is focused on the need to identify, analyse, evalute and treat the AI system impacts on individuals and the society, adopting a well structured approach for the assessment.

Annex A, Control A.6 «AI system Life Cycle»

According to the Annex A control A.6, the every stage of AI system life cycle has to be managed through an approach (framework) that helps to ensure responsability and effectiveness on design, implementation and use of AI system.

Annex A, Control A.7 «Data for AI sytem»

The data quality and the source it comes from are very relevant for AI system: every organization has to manage carefully the definition and documentationabout requirements and standards.

Annex A, Control A.8 «Information for parts interested in AI systems»

According to the Annex A control A.8, organizations have to determine and share AI systems essential informations (purpose, instructions, limitations, capabilities,...) to users and other stakeholders.

Annex A, Control A.9 «Use of AI systems»

The Annex A control A.9 requires to define and document the process for the AI systems responsible use, in particular according to ethics, legal requirements and policies of the organization.

Annex A, Control A.10 «Thir parties and customer relationships»

According to the Annex A control A.10, organizations have to delineate internal and external responsabilities on AI systems, in particular among partners, suppliers and other third parties.

The correlations between ISO 42001 Annex A and other standards

We should remember that the the ISO 42001:2023 Annex A has relevant correlations with other standards, in particular the following ones:

ISO 27001 Information Security (Appendix A Operational Controls);
IT Services ISO 20000-1

If you want to keep you up-to-date with the most recent news on this topic, don't forget to subscribe to our newsletter!

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

La resilienza aziendale: esempi pratici di attività ricorrenti e manutenzioni essenziali

Mon, 03 Mar 2025 12:05:39 +0100

Tempo di lettura stimato: ~ 4 min.

L'implementazione del concetto di resilienza aziendale all'interno dell'organizzazione

Nel secondo post della nostra serie dedicata alla resilienza aziendale, abbiamo visto come costruirla sia dentro sia fuori dell'area ICT di un'organizzazione.

Il terzo (e conclusivo) contributo si sofferma sul tema delle «attività ricorrenti e pratiche di manutenzione essenziali», fornendo una serie di esempi concreti che sono utili a capire come un'organizzazione possa effettivamente implementare il concetto di resilienza aziendale.

Gli esempi di attività ricorrenti e pratiche di manutenzione essenziale nell'implementazione della resilienza aziendale

Di seguito, alcuni esempi di attività ricorrenti e pratiche di manutenzione essenziali tramite le quali si concretizza il concetto di resilienza aziendale all'interno di un'organizzazione:

A. Monitoraggio e aggiornamento della valutazione dei rischi

Revisione periodica dei rischi aziendali: è cruciale effettuare una valutazione regolare dei rischi non ICT per identificare nuove minacce e adattare il piano di continuità operativa (BCP). Ciò include l'analisi delle variabili esterne come i cambiamenti normativi, le fluttuazioni economiche e l'evoluzione della supply chain.
Test e simulazioni: simulare scenari di crisi non tecnologici, come interruzioni della catena di approvvigionamento o emergenze logistiche, per valutare l'efficacia del piano di risposta e apportare miglioramenti basati sui risultati ottenuti.

B. Manutenzione dei processi operativi

Ottimizzazione dei processi: conduzione di audit periodici dei processi aziendali per verificare che le pratiche operative siano aggiornate e flessibili. Implementare miglioramenti continui per garantire che i processi possano adattarsi rapidamente ai cambiamenti di mercato o interni.
Revisione della logistica e dell'approvvigionamento: aggiornare costantemente le strategie logistiche per affrontare potenziali interruzioni e garantire un approvvigionamento stabile e sicuro.

C. Aggiornamento delle competenze del capitale umano

Programmi di formazione ricorrenti: pianificare sessioni di formazione periodiche per i dipendenti, mirate allo sviluppo delle competenze chiave come la gestione dello stress, il problem-solving e la leadership in situazioni critiche.
Feedback e miglioramento continuo: implementare meccanismi di feedback per monitorare l'efficacia delle formazioni e apportare modifiche ai programmi in base alle esigenze emergenti e alle nuove sfide.

D. Manutenzione della comunicazione interna ed esterna

Verifica dei protocolli di comunicazione: effettuare controlli regolari dei protocolli di comunicazione per garantire che siano adeguati alle esigenze aziendali e alle aspettative delle parti interessate. Ciò include l'aggiornamento delle linee guida per la gestione delle crisi e delle emergenze.

Simulazioni di comunicazione: realizzare esercitazioni per testare la capacità del team di mantenere una comunicazione chiara e efficace durante situazioni stressanti o eventi imprevisti.

E. Manutenzione della cultura e della resilienza

Valutazione periodica della cultura aziendale: monitorare attraverso sondaggi interni e incontri la percezione dei dipendenti riguardo alla cultura della resilienza e all'adattabilità dell'azienda. Assicurarsi che ci sia un allineamento tra i valori aziendali e le pratiche quotidiane.

Sessioni di team-building: organizzare regolarmente attività di team-building che incoraggino la collaborazione, la proattività e il pensiero creativo, fondamentali per mantenere alta la motivazione e la capacità di problem-solving durante le sfide.

F. Pianificazione della manutenzione preventiva

Piano di manutenzione annuale: strutturare un piano annuale che includa scadenze specifiche per la manutenzione di tutti gli aspetti sopra elencati. Questo piano dovrebbe prevedere revisioni trimestrali e un aggiornamento completo almeno una volta l'anno.

Indicatori di prestazione chiave (KPI): definire e monitorare KPI specifici per misurare l'efficacia delle attività di manutenzione e dei processi operativi, come il tempo di risposta alle emergenze o la capacità di mantenere la produttività durante le crisi.

La tabella riepilogativa di rischi, responsabilità ed azioni per rafforzare la resilienza aziendale

Tramite questa semplice tabella possiamo visualizzare e confrontare efficacemente i rischi individuati, nonché definire le responsabilità e stabilire quali azioni devono essere intraprese per rafforzare la resilienza aziendale.

Area di Resilienza	Tipo di Rischio	Impatto Potenziale	Probabilità di Occorrenza	Misure di Mitigazione	Responsabile	Priorità
Tecnologia (ICT)	Attacchi informatici	Alto	Alta	Sistemi di sicurezza avanzati, backup regolari	IT Manager	Alta
Software (ICT)	Malfunziona-menti software	Medio	Media	Test periodici e aggiornamenti	Responsabile QA	Media
Infrastruttu- ra (ICT)	Guasti hardware	Medio	Bassa	Contratti di manutenzione, hardware ridondante	Tecnico IT	Media
Supply Chain (NON ICT)	Ritardi nella fornitura	Alto	Media	Diversificazione fornitori	Responsabile Logistica	Alta
Risorse Umane (NON ICT)	Assenza di personale critico	Medio	Bassa	Piano di successione e formazione incrociata	HR Manager	Media
Ambiente (NON ICT)	Disastri naturali	Alto	Bassa	Assicurazioni e piani di evacuazione	Facility Manager	Alta

Ecco come leggere e utilizzare la tabella:

Area di Resilienza: Differenzia se l'elemento in questione è legato all'ICT o a fattori non ICT.
Tipo di Rischio: Identifica il rischio specifico per l'area indicata.
Impatto Potenziale: Valuta l'entità del danno in caso di manifestazione del rischio (es. basso, medio, alto).
Probabilità di Occorrenza: Stima la frequenza con cui il rischio potrebbe verificarsi (es. bassa, media, alta).
Misure di Mitigazione: Specifica le azioni da intraprendere per ridurre il rischio o gestirne l'impatto.
Responsabile: Indica la figura o il reparto responsabile dell'attuazione delle misure.
Priorità: Determina l'urgenza dell'intervento, basata sulla combinazione di impatto e probabilità (es. bassa, media, alta).

Autore: Aurelio Stefanoni

Senior Manager, iuXta Management Consulting

Per non perdere i prossimi aggiornamenti sul tema della resilienza aziendale, iscriviti subito alla nostra newsletter: ti proponiamo contenuti esclusivi, aggiornamenti costanti sulle nostre attività e benefici riservati alla nostra community.

ISCRIVITI ALLA NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Understanding AI terms and definitions according to the standard ISO 22989

Wed, 19 Feb 2025 07:00:00 +0100

Reading time: ~ 7 min.

AI terms and definitions according to the standard ISO 22989

These days, we can find products and services everywhere claiming that improve productivity and boost performance thanks to AI. It is no difficult to find different kind of references to the artificial intelligence with terms and definitions not always «standardized».

In our today post, we're going to take a look at the ISO 22989:2022 standard on «information technology — artificial intelligence — artificial intelligence concepts and terminology», which provides an AI terminology and some description on concepts in the artificial intelligence field.

It is important to note that this document can be used to develop other standard as well as it can be a useful to manage the communication between different stakeholders with a common point of reference.

The ISO 22989:2022 is suitable indeed for a many different types of organizations (businesses, government agencies, nonprofit organizations).

Focus on the ISO/IEC 22989:2022 standard and its clauses

Please bear in mind that the ISO/IEC 22989:2022 standard has a direct relation to the ISO/IEC 42001:2023 on «Information technology Artificial intelligence management system», a standard we have already written about some months ago on our blog.

Let's have a look now at the ISO 22989 standard, which is divided into these clauses:

✅ 1. Scope

✅ 2. Normative references

✅ 3. Terms and definitions

✅ 4. Abbreviated terms

✅ 5. AI Concepts

✅ 6. AI systems life cycle

✅ 7. AI system functional overview

✅ 8. AI Ecosystem

✅ 9. Fields or AI

✅ 10. Application or AI Systems

✅ Annex A: Mapping of the AI systems life cycle with the OECD's definition of an AI system life cycle.

We're going now to take a closer look at the section «3» of ISO 22989:2022 standard.

The ISO 22989:2022 standard section 3: terms related to AI

On the section 3, the ISO 22989:2022 standard provides us a well-structured and useful focus about AI terms and definitions. Let's have first a look at the artificial intelligence related terms.

📘 3.1 Terms related to AI

📕 3.1.1 AI agent: automated (3.1.7) entity that senses and responds to its environment and takes actions to achieve its goals.

📕 3.1.2 AI component: functional element that constructs an AI system (3.1.4).

📕 3.1.3 artificial intelligence, AI: research and development of mechanisms and applications of AI systems (3.1.4).

Note 1 to entry: Research and development can take place across any number of fields such as computer science, data science, humanities, mathematics and natural sciences.

📕 3.1.4 artificial intelligence system, AI system: engineered system that generates outputs such as content, forecasts, recommendations or decisions for a given set of human-defined objectives.

Note 1 to entry: The engineered system can use various techniques and approaches related to artificial intelligence (3.1.3) to develop a model (3.1.23) to represent data, knowledge (3.1.21), processes, etc. which can be used to conduct tasks (3.1.35).

Note 2 to entry: AI systems are designed to operate with varying levels of automation (3.1.7).

📕 3.1.5 autonomy, autonomous: characteristic of a system that is capable of modifying its intended domain of use or goal without external intervention, control or oversight.

📕 3.1.6 application specific integrated circuit, ASIC: integrated circuit customized for a particular use.

[SOURCE:ISO/IEC/IEEE 24765:2017, 3.193, modified — Acronym has been moved to separate line.]

📕 3.1.7 automatic, automation, automated: pertaining to a process or system that, under specified conditions, functions without human intervention.

[SOURCE:ISO/IEC 2382:2015, 2121282, modified — In the definition, “a process or equipment” has been replaced by “a process or system” and preferred terms of “automated and automation” are added.]

📕 3.1.8 cognitive computing: category of AI systems (3.1.4) that enables people and machines to interact more naturally.

Note 1 to entry: Cognitive computing tasks are associated with machine learning (3.3.5), speech processing, natural language processing (3.6.9), computer vision (3.7.1) and human-machine interfaces.

📕 3.1.9 continuous learning, continual learning, lifelong learning: incremental training of an AI system (3.1.4) that takes place on an ongoing basis during the operation phase of the AI system life cycle.

📕 3.1.10 connectionism, connectionist paradigm, connectionist model, connectionist approach: form of cognitive modelling that uses a network of interconnected units that generally are simple computational units.

📕3.1.11 data mining: computational process that extracts patterns by analysing quantitative data from different perspectives and dimensions, categorizing them, and summarizing potential relationships and impacts.

[SOURCE:ISO 16439:2014, 3.13, modified — replace “categorizing it” with “categorizing them” because data is plural.]

📕 3.1.12 declarative knowledge: knowledge represented by facts, rules and theorems

Note 1 to entry: Usually, declarative knowledge cannot be processed without first being translated into procedural knowledge (3.1.28).

[SOURCE:ISO/IEC 2382-28:1995, 28.02.22, modified — Remove comma after “rules” in the definition.]

📕 3.1.13 expert system: AI system (3.1.4) that accumulates, combines and encapsulates knowledge (3.1.21) provided by a human expert or experts in a specific domain to infer solutions to problems.

📕 3.1.14 general AI, AGI, artificial general intelligence: type of AI system (3.1.4) that addresses a broad range of tasks (3.1.35) with a satisfactory level of performance.

Note 1 to entry: Compared to narrow AI (3.1.24).

Note 2 to entry: AGI is often used in a stronger sense, meaning systems that not only can perform a wide variety of tasks, but all tasks that a human can perform.

📕 3.1.15 genetic algorithm, GA: algorithm which simulates natural selection by creating and evolving a population of individuals (solutions) for optimization problems.

📕 3.1.16 heteronomy, heteronomous: characteristic of a system operating under the constraint of external intervention, control or oversight.

📕 3.1.17 inference: reasoning by which conclusions are derived from known premises.

Note 1 to entry: In AI, a premise is either a fact, a rule, a model, a feature or raw data.

Note 2 to entry: The term "inference" refers both to the process and its result.

[SOURCE:ISO/IEC 2382:2015, 2123830, modified – Model, feature and raw data have been added. Remove “Note 4 to entry: 28.03.01 (2382)”. Remove “Note 3 to entry: inference: term and definition standardized by ISO/IEC 2382-28:1995”.]

📕 3.1.18 internet of things, IoT: infrastructure of interconnected entities, people, systems and information resources together with services that process and react to information from the physical world and virtual world.

[SOURCE:ISO/IEC 20924:2021, 3.2.4, modified – “…services which processes and reacts to…” has been replaced with “…services that process and react to…” and acronym has been moved to separate line.]

📕 3.1.19 IoT device: entity of an IoT system (3.1.20) that interacts and communicates with the physical world through sensing or actuating.

Note 1 to entry: An IoT device can be a sensor or an actuator.

[SOURCE:ISO/IEC 20924:2021, 3.2.6]

📕 3.1.20 IoT system: system providing functionalities of IoT (3.1.18).

Note 1 to entry: An IoT system can include, but not be limited to, IoT devices, IoT gateways, sensors and actuators.

[SOURCE:ISO/IEC 20924:2021, 3.2.9]

📕 3.1.21knowledge: abstracted information about objects, events, concepts or rules, their relationships and properties, organized for goal-oriented systematic use.

Note 1 to entry: Knowledge in the AI domain does not imply a cognitive capability, contrary to usage of the term in some other domains. In particular, knowledge does not imply the cognitive act of understanding.

Note 2 to entry: Information can exist in numeric or symbolic form.

Note 3 to entry: Information is data that has been contextualized, so that it is interpretable. Data is created through abstraction or measurement from the world.

📕 3.1.22 life cycle: evolution of a system, product, service, project or other human-made entity, from conception through retirement.

[SOURCE:ISO/IEC/IEEE 15288:2015, 4.1.23]

📕 3.1.23 model: physical, mathematical or otherwise logical representation of a system, entity, phenomenon, process or data.

[SOURCE:ISO/IEC 18023-1:2006, 3.1.11, modified – Remove comma after “mathematical” in the definition. "or data" is added at the end.]

📕 3.1.24 narrow AI: type of AI system (3.1.4) that is focused on defined tasks (3.1.35) to address a specific problem.

Note 1 to entry: Compared to general AI (3.1.14).

📕 3.1.25 performance: measurable result.

Note 1 to entry: Performance can relate either to quantitative or qualitative findings.

Note 2 to entry: Performance can relate to managing activities, processes, products (including services), systems or organizations.

📕3.1.26 planning: computational processes that compose a workflow out of a set of actions, aiming at reaching a specified goal.

Note 1 to entry: The meaning of the “planning” used in AI life cycle or AI management standards can be also actions taken by human beings.

📕 3.1.27 prediction: primary output of an AI system (3.1.4) when provided with input data (3.2.9) or information.

Note 1 to entry: Predictions can be followed by additional outputs, such as recommendations, decisions and actions.

Note 2 to entry: Prediction does not necessarily refer to predicting something in the future.

Note 3 to entry: Predictions can refer to various kinds of data analysis or production applied to new data or historical data (including translating text, creating synthetic images or diagnosing a previous power failure).

📕 3.1.28 procedural knowledge: knowledge which explicitly indicates the steps to be taken in order to solve a problem or to reach a goal.

[SOURCE:ISO/IEC 2382-28:1995, 28.02.23]

📕 3.1.29 robot: automation system with actuators that performs intended tasks (3.1.35) in the physical world, by means of sensing its environment and a software control system.

Note 1 to entry: A robot includes the control system and interface of a control system.

Note 2 to entry: The classification of a robot as industrial robot or service robot is done according to its intended application.

Note 3 to entry: In order to properly perform its tasks (3.1.35), a robot makes use of different kinds of sensors to confirm its current state and perceive the elements composing the environment in which it operates.

📕 3.1.30 robotics: science and practice of designing, manufacturing and applying robots.

[SOURCE:ISO 8373:2012, 2.16]

📕 3.1.31 semantic computing: field of computing that aims to identify the meanings of computational content and user intentions and to express them in a machine-processable form.

📕 3.1.32 soft computing: field of computing that is tolerant of and exploits imprecision, uncertainty and partial truth to make problem-solving more tractable and robust

Note 1 to entry: Soft computing encompasses various techniques such as fuzzy logic, machine learning and probabilistic reasoning.

📕 3.1.33 symbolic AI: AI (3.1.3) based on techniques and models (3.1.23) that manipulate symbols and structures according to explicitly defined rules to obtain inferences

Note 1 to entry: Compared to subsymbolic AI (3.1.34), symbolic AI produces declarative outputs, whereas subsymbolic AI is based on statistical approaches and produces outputs with a given probability of error.

📕 3.1.34 subsymbolic AI: AI (3.1.3) based on techniques and models (3.1.23) that use an implicit encoding of information, that can be derived from experience or raw data.

Note 1 to entry: Compared to symbolic AI (3.1.33). Whereas symbolic AI produces declarative outputs, subsymbolic AI is based on statistical approaches and produces outputs with a given probability of error.

📕 3.1.35 task: action required to achieve a specific goal.

Note 1 to entry: Actions can be physical or cognitive. For instance, computing or creation of predictions (3.1.27), translations, synthetic data or artefacts or navigating through a physical space.

Note 2 to entry: Examples of tasks include classification, regression, ranking, clustering and dimensionality reduction.

The ISO 22989:2022 standard section 3: terms related to data

On the section 3, the ISO 22989:2022 standard provides us a well-structured and useful focus about AI terms and definitions. Let's have a look now at the terms related to data.

📘 3.2 Terms related to data

📕 3.2.1 data annotation: process of attaching a set of descriptive information to data without any change to that data.

Note 1 to entry: The descriptive information can take the form of metadata, labels and anchors.

📕3.2.2 data quality checking: process in which data is examined for completeness, bias and other factors which affect its usefulness for an AI system (3.1.4).

📕 3.2.3 data augmentation: process of creating synthetic samples by modifying or utilizing the existing data.

📕 3.2.4 data sampling: process to select a subset of data samples intended to present patterns and trends similar to that of the larger dataset (3.2.5) being analysed.

Note 1 to entry: Ideally, the subset of data samples will be representative of the larger dataset (3.2.5).

📕 3.2.5 dataset: collection of data with a shared format.

EXAMPLE 1:

Micro-blogging posts from June 2020 associated with hashtags #rugby and #football.

EXAMPLE 2:

Macro photographs of flowers in 256x256 pixels.

Note 1 to entry: Datasets can be used for validating or testing an AI model (3.1.23). In a machine learning (3.3.5) context, datasets can also be used to train a machine learning algorithm (3.3.6).

📕 3.2.6 exploratory data analysis, EDA: initial examination of data to determine its salient characteristics and assess its quality.

Note 1 to entry: EDA can include identification of missing values, outliers, representativeness for the task at hand – see data quality checking (3.2.2).

📕 3.2.7 ground truth: value of the target variable for a particular item of labelled input data.

Note 1 to entry: The term ground truth does not imply that the labelled input data consistently corresponds to the real-world value of the target variables.

📕 3.2.8 imputation: procedure where missing data are replaced by estimated or modelled data

[SOURCE:ISO 20252:2019, 3.45]

📕 3.2.9 input data: data for which an AI system (3.1.4) calculates a predicted output or inference.

📕 3.2.10 label: target variable assigned to a sample.

📕 3.2.11personally identifiable information, PII personal data: any information that (a) can be used to establish a link between the information and the natural person to whom such information relates, or (b) is or can be directly or indirectly linked to a natural person.

Note 1 to entry: The “natural person” in the definition is the PII principal. To determine whether a PII principal is identifiable, account should be taken of all the means which can reasonably be used by the privacy stakeholder holding the data, or by any other party, to establish the link between the set of PII and the natural person.

Note 2 to entry: This definition is included to define the term PII as used in this document. A public cloud PII processor is typically not in a position to know explicitly whether information it processes falls into any specified category unless this is made transparent by the cloud service customer.

[SOURCE:ISO/IEC 29100:2011/Amd1:2018, 2.9]

📕 3.2.12 production data: data acquired during the operation phase of an AI system (3.1.4), for which a deployed AI system (3.1.4) calculates a predicted output or inference (3.1.17).

📕 3.2.13 sample: atomic data element processed in quantities by a machine learning algorithm (3.3.6) or an AI system (3.1.4).

📕 3.2.14 test data, evaluation data: data used to assess the performance of a final model (3.1.23)

Note 1 to entry: Test data is disjoint from training data (3.3.16) and validation data (3.2.15).

📕 3.2.15 validation data, development data: data used to compare the performance of different candidate models (3.1.23).

Note 1 to entry: Validation data is disjoint from test data (3.2.14) and generally also from training data (3.3.16). However, in cases where there is insufficient data for a three-way training, validation and test set split, the data is divided into only two sets – a test set and a training or validation set. Cross-validation or bootstrapping are common methods for then generating separate training and validation sets from the training or validation set.

Note 2 to entry: Validation data can be used to tune hyperparameters or to validate some algorithmic choices, up to the effect of including a given rule in an expert system.

The ISO 22989:2022 standard section 3: terms related to machine learning

On the section 3, the ISO 22989:2022 standard provides us a well-structured and useful focus about AI terms and definitions. Let's have a look now at the terms related to machine learning.

📘 3.3 Terms related to machine learning

📕 3.3.1 Bayesian network: probabilistic model (3.1.23) that uses Bayesian inference (3.1.17) for probability computations using a directed acyclic graph.

📕 3.3.2 decision tree: model (3.1.23) for which inference (3.1.17) is encoded as paths from the root to a leaf node in a tree structure.

📕 3.3.3 human-machine teaming: integration of human interaction with machine intelligence capabilities.

📕 3.3.4 hyperparameter: characteristic of a machine learning algorithm (3.3.6) that affects its learning process.

Note 1 to entry: Hyperparameters are selected prior to training and can be used in processes to help estimate model parameters.

Note 2 to entry: Examples of hyperparameters include the number of network layers, width of each layer, type of activation function, optimization method, learning rate for neural networks; the choice of kernel function in a support vector machine; number of leaves or depth of a tree; the K for K-means clustering; the maximum number of iterations of the expectation maximization algorithm; the number of Gaussians in a Gaussian mixture.

📕 3.3.5 machine learning, ML: process of optimizing model parameters (3.3.8) through computational techniques, such that the model's (3.1.23) behaviour reflects the data or experience

📕 3.3.6 machine learning algorithm: algorithm to determine parameters (3.3.8) of a machine learning model (3.3.7) from data according to given criteria

EXAMPLE:

Consider solving a univariate linear function y = θ₀ + θ₁x where y is an output or result, x is an input, θ₀ is an intercept (the value of y where x=0) and θ₁ is a weight. In machine learning (3.3.5), the process of determining the intercept and weights for a linear function is known as linear regression.

📕 3.3.7 machine learning model: mathematical construct that generates an inference (3.1.17) or prediction (3.1.27) based on input data or information

EXAMPLE:

If a univariate linear function (y = θ₀ + θ₁x) has been trained using linear regression, the resulting model can be y = 3 + 7x.

Note 1 to entry: A machine learning model results from training based on a machine learning algorithm (3.3.6).

📕 3.3.8 parameter, model parameter: internal variable of a model (3.1.23) that affects how it computes its outputs

Note 1 to entry: Examples of parameters include the weights in a neural network and the transition probabilities in a Markov model.

📕 3.3.9 reinforcement learning, RL: learning of an optimal sequence of actions to maximize a reward through interaction with an environment.

📕 3.3.10 retraining: updating a trained model (3.3.14) by training (3.3.15) with different training data (3.3.16).

📕 3.3.11 semi-supervised machine learning: machine learning (3.3.5) that makes use of both labelled and unlabelled data during training (3.3.15).

📕 3.3.12 supervised machine learning: machine learning (3.3.5) that makes only use of labelled data during training (3.3.15).

📕 3.3.13 support vector machine, SVM: machine learning algorithm (3.3.6) that finds decision boundaries with maximal margins

Note 1 to entry: Support vectors are sets of data points that define the positioning of the decision boundaries (hyper-planes).

📕 3.3.14 trained model: result of model training (3.3.15).

📕 3.3.15 training, model training: process to determine or to improve the parameters of a machine learning model (3.3.7), based on a machine learning algorithm (3.2.10), by using training data (3.3.16)

📕 3.3.16 training data: data used to train a machine learning model (3.3.7)

📕 3.3.17 unsupervised machine learning: machine learning (3.3.5) that makes only use of unlabelled data during training (3.3.15).

The ISO 22989:2022 standard section 3: terms related to neural networks

On the section 3, the ISO 22989:2022 standard provides us a well-structured and useful focus about AI terms and definitions. Let's have a look now at the terms related to neural networks.

📘 3.4 Terms related to neural networks

📕 3.4.1 activation function: function applied to the weighted combination of all inputs to a neuron (3.4.9).

Note 1 to entry: Activation functions allow neural networks to learn complicated features in the data. They are typically non-linear.

📕 3.4.2 convolutional neural network, CNN, deep convolutional neural network, DCNN: feed forward neural network (3.4.6) using convolution (3.4.3) in at least one of its layers.

📕 3.4.3 convolution: mathematical operation involving a sliding dot product or cross-correlation of the input data.

📕 3.4.4 deep learning, deep neural network learning: approach to creating rich hierarchical representations through the training (3.3.15) of neural networks (3.4.8) with many hidden layers.

Note 1 to entry: Deep learning is a subset of ML (3.3.5).

📕 3.4.5 exploding gradient: phenomenon of backpropagation training (3.3.15) in a neural network where large error gradients accumulate and result in very large updates to the weights, making the model (3.1.23) unstable.

📕 3.4.6 feed forward neural network, FFNN: neural network (3.4.8) where information is fed from the input layer to the output layer in one direction only.

📕 3.4.7 long short-term memory, LSTM: type of recurrent neural network (3.4.10) that processes sequential data with a satisfactory performance for both long and short span dependencies.

📕 3.4.8 neural network, NN, neural net, artificial neural network:

network of one or more layers of neurons (3.4.9) connected by weighted links with adjustable weights, which takes input data and produces an output.

Note 1 to entry: Neural networks are a prominent example of the connectionist approach (3.1.10).

Note 2 to entry: Although the design of neural networks was initially inspired by the functioning of biological neurons, most works on neural networks do not follow that inspiration anymore.

📕 3.4.9 neuron: primitive processing element which takes one or more input values and produces an output value by combining the input values and applying an activation function (3.4.1) on the result.

Note 1 to entry: Examples of nonlinear activation functions are a threshold function, a sigmoid function and a polynomial function.

📕 3.4.10 recurrent neural network, RNN: neural network (3.4.8) in which outputs from both the previous layer and the previous processing step are fed into the current layer.

The ISO 22989:2022 standard section 3: terms related to trustworthiness

On the section 3, the ISO 22989:2022 standard provides us a well-structured and useful focus about AI terms and definitions. Let's have a look now at the terms related to trustworthiness.

📘 3.5 Terms related to trustworthiness

📕 3.5.1 accountable: answerable for actions, decisions and performance

[SOURCE:ISO/IEC 38500:2015, 2.2]

📕 3.5.2 accountability: state of being accountable (3.5.1).

Note 1 to entry: Accountability relates to an allocated responsibility. The responsibility can be based on regulation or agreement or through assignment as part of delegation.

Note 2 to entry: Accountability involves a person or entity being accountable for something to another person or entity, through particular means and according to particular criteria.

[SOURCE:ISO/IEC 38500:2015, 2.3, modified — Note 2 to entry is added.]

📕 3.5.3 availability: property of being accessible and usable on demand by an authorized entity.

[SOURCE:ISO/IEC 27000:2018, 3.7]

📕 3.5.4 bias: systematic difference in treatment of certain objects, people or groups in comparison to others.

Note 1 to entry: Treatment is any kind of action, including perception, observation, representation, prediction (3.1.27) or decision.

[SOURCE:ISO/IEC TR 24027:2021, 3.3.2, modified – remove oxford comma in definition and note to entry]

📕 3.5.5 control: purposeful action on or in a process to meet specified objectives.

[SOURCE:IEC 61800-7-1:2015, 3.2.6]

📕 3.5.6 controllability, controllable: property of an AI system (3.1.4) that allows a human or another external agent to intervene in the system’s functioning.

📕 3.5.7 explainability: property of an AI system (3.1.4) to express important factors influencing the AI system (3.1.4) results in a way that humans can understand.

Note 1 to entry: It is intended to answer the question “Why?” without actually attempting to argue that the course of action that was taken was necessarily optimal.

📕 3.5.8 predictability: property of an AI system (3.1.4) that enables reliable assumptions by stakeholders (3.5.13) about the output.

[SOURCE:ISO/IEC TR 27550:2019, 3.12, “by individuals, owners, and operators about the PII and its processing by a system” has been replaced with “by stakeholders about the outputs”.]

📕 3.5.9 reliability: property of consistent intended behaviour and results.

[SOURCE:ISO/IEC 27000:2018, 2.55]

📕 3.5.10 resilience: ability of a system to recover operational condition quickly following an incident.

📕 3.5.11risk: effect of uncertainty on objectives.

Note 1 to entry: An effect is a deviation from the expected. It can be positive, negative or both and can address, create or result in opportunities and threats.

Note 2 to entry: Objectives can have different aspects and categories and can be applied at different levels.

Note 3 to entry: Risk is usually expressed in terms of risk sources, potential events, their consequences and their likelihood.

[SOURCE:ISO 31000:2018, 3.1, modified — Remove comma after “both” in Note 1 to entry. Remove comma after “categories” in Note 2 to entry.]

📕 3.5.12 robustness: ability of a system to maintain its level of performance under any circumstances.

📕3.5.13 stakeholder: any individual, group, or organization that can affect, be affected by or perceive itself to be affected by a decision or activity.

[SOURCE:ISO/IEC 38500:2015, 2.24, modified — Remove comma after “be affected by” in the definition.]

📕 3.5.14 transparency: property of an organization that appropriate activities and decisions are communicated to relevant stakeholders (3.5.13) in a comprehensive, accessible and understandable manner.

Note 1 to entry: Inappropriate communication of activities and decisions can violate security, privacy or confidentiality requirements.

📕 3.5.15 transparency: property of a system that appropriate information about the system is made available to relevant stakeholders (3.5.13).

Note 1 to entry: Appropriate information for system transparency can include aspects such as features, performance, limitations, components, procedures, measures, design goals, design choices and assumptions, data sources and labelling protocols.

Note 2 to entry: Inappropriate disclosure of some aspects of a system can violate security, privacy or confidentiality requirements.

📕 3.5.16 trustworthiness: ability to meet stakeholder (3.5.13) expectations in a verifiable way.

Note 1 to entry: Depending on the context or sector, and also on the specific product or service, data and technology used, different characteristics apply and need verification to ensure stakeholders’ (3.5.13) expectations are met.

Note 2 to entry: Characteristics of trustworthiness include, for instance, reliability, availability, resilience, security, privacy, safety, accountability, transparency, integrity, authenticity, quality and usability.

Note 3 to entry: Trustworthiness is an attribute that can be applied to services, products, technology, data and information as well as, in the context of governance, to organizations.

[SOURCE:ISO/IEC TR 24028:2020, 3.42, modified — Stakeholders’ expectations replaced by stakeholder expectations; comma between quality and usability replaced by “and”.]

📕 3.5.17 verification: confirmation, through the provision of objective evidence, that specified requirements have been fulfilled.

Note 1 to entry: Verification only provides assurance that a product conforms to its specification.

[SOURCE:ISO/IEC 27042:2015, 3.21]

📕 3.5.18 validation: confirmation, through the provision of objective evidence, that the requirements for a specific intended use or application have been fulfilled.

[SOURCE:ISO/IEC 27043:2015, 3.16]

The ISO 22989:2022 standard section 3: terms related to natural language processing

On the section 3, the ISO 22989:2022 standard provides us a well-structured and useful focus about AI terms and definitions. Let's have a look now at the terms related to natural language processing.

📘 3.6 Terms related to natural language processing

📕 3.6.1 automatic summarization: task (3.1.35) of shortening a portion of natural language (3.6.7) content or text while retaining important semantic information.

📕 3.6.2 dialogue management: task (3.1.35) of choosing the appropriate next move in a dialogue based on user input, the dialogue history and other contextual knowledge (3.1.21), to meet a desired goal.

📕 3.6.3 emotion recognition: task (3.1.35) of computationally identifying and categorizing emotions expressed in a piece of text, speech, video or image or combination thereof.

Note 1 to entry: Examples of emotions include happiness, sadness, anger and delight.

📕 3.6.4 information retrieval, IR: task (3.1.35) of retrieving relevant documents or parts of documents from a dataset (3.2.5), typically based on keyword or natural language (3.6.7) queries.

📕 3.6.5 machine translation, MT: task (3.1.35) of automated translation of text or speech from one natural language (3.6.7) to another using a computer system.

[SOURCE:ISO 17100:2015, 2.2.2]

📕 3.6.6 named entity recognition, NER: task (3.1.35) of recognizing and labelling the denotational names of entities and their categories for sequences of words in a stream of text or speech

Note 1 to entry: Entity refers to concrete or abstract thing of interest, including associations among things.

Note 2 to entry: “Named entity” refers to an entity with a denotational name where a specific or unique meaning exists.

Note 3 to entry: Denotational names include the specific names of persons, locations, organizations and other proper names based on the domain or application.

📕 3.6.7 natural language: language that is or was in active use in a community of people and whose rules are deduced from usage

Note 1 to entry: Natural language is any human language, which can be expressed in text, speech, sign language, etc.

Note 2 to entry: Natural language is any human language, such as English, Spanish, Arabic, Chinese or Japanese, to be distinguished from programming and formal languages, such as Java, Fortran, C++ or First-Order Logic.

[SOURCE:ISO/IEC 15944-8:2012, 3.82, modified — “and the rules of which are mainly deduced from the usage” replaced by “and its rules are deduced from usage. Removed comma after “Chinese” in Note 2 to entry 3.6.8]

📕 3.6.8 natural language generation, NLG: task (3.1.35) of converting data carrying semantics into natural language (3.6.7).

📕 3.6.9 natural language processing, NLP: information processing based upon natural language understanding (3.6.11) or natural language generation (3.6.8).

📕 3.6.10 natural language processing, NLP: discipline concerned with the way systems acquire, process and interpret natural language (3.6.7).

📕 3.6.11 natural language understanding, NLU, natural language comprehension: extraction of information, by a functional unit, from text or speech communicated to it in a natural language (3.6.7), and the production of a description for both the given text or speech and what it represents.

[SOURCE:ISO/IEC 2382:2015, 2123786, modified – Note to entry has been removed, hyphen in natural-language has been removed, NLU has been added.]

📕 3.6.12 optical character recognition, OCR: conversion of images of typed, printed or handwritten text into machine-encoded text.

📕 3.6.13 part-of-speech tagging: task (3.1.35) of assigning a category (e.g. verb, noun, adjective) to a word based on its grammatical properties.

📕 3.6.14 question answering: task (3.1.35) of determining the most appropriate answer to a question provided in natural language (3.6.7)

Note 1 to entry: A question can be open-ended or be intended to have a specific answer.

📕 3.6.15 relationship extraction, relation extraction: task (3.1.35) of identifying relationships among entities mentioned in a text.

📕 3.6.16 sentiment analysis: task (3.1.35) of computationally identifying and categorizing opinions expressed in a piece of text, speech or image, to determine a range of feeling such as from positive to negative.

Note 1 to entry: Examples of sentiments include approval, disapproval, positive toward, negative toward, agreement and disagreement.

📕 3.6.17 speech recognition, speech-to-text, STT: conversion, by a functional unit, of a speech signal to a representation of the content of the speech.

[SOURCE:ISO/IEC 2382:2015, 2120735, modified — Note to entry has been removed.]

📕 3.6.18 speech synthesis, text-to-speech, TTS: generation of artificial speech.

[SOURCE:ISO/IEC 2382: 2015, 2120745]

The ISO 22989:2022 standard section 3: terms related to computer vision

On the section 3, the ISO 22989:2022 standard provides us a well-structured and useful focus about AI terms and definitions. Let's have a look now at the terms related to computer vision.

📘 3.7 Terms related to computer vision

📕 3.7.1 computer vision: capability of a functional unit to acquire, process and interpret data representing images or video.

Note 1 to entry: Computer vision involves the use of sensors to create a digital image of a visual scene. This can include images, such as images that capture wavelengths beyond those of visible light such as infrared imaging.

📕 3.7.2 face recognition: automatic pattern recognition comparing stored images of human faces with the image of an actual face, indicating any matching, if it exists, and any data, if they exist, identifying the person to whom the face belongs.

[SOURCE:ISO 5127:2017, 3.1.12.09]

📕 3.7.3 image: graphical content intended to be presented visually.

Note 1 to entry: This includes graphics that are encoded in any electronic format, including, but not limited to, formats that are comprised of individual pixels (e.g. those produced by paint programs or by photographic means) and formats that comprised of formulas (e.g. those produced as scalable vector drawings).

[SOURCE:ISO/IEC 20071-11:2019, 3.2.1]

📕 3.7.4 image recognition: image classification process that classifies object(s), pattern(s) or concept(s) in an image (3.7.3).

EU AI Act and the main useful ISO standards

The EU Artificial Intelligence Act brings new challenges in terms of compliance of AI services and products. Let's take a final look at our inographic to better figure out the relationship between the European Regulation and the main ISO standards:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us on our social media channels or subscribe to our newsletter: you will receive exclusive content for our community!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors: