Guidance standards: 23894 and 42005, and the word "shall"

Not every standard imposes anything. The distinction between a requirements standard and a guidance standard is the difference between a document you can be audited against and a document that helps you think, and it is carried by a single word.

Requirements and guidance

In the drafting conventions these standards follow, "shall" states a requirement. A standard that contains requirements can be certified against, because there is something definite to conform to. A standard that offers guidance, recommendations and possibilities cannot, because there is nothing to fail.

ISO/IEC 23894:2023, on AI risk management, is a guidance standard. It contains no "shall" requirements. Nothing in it is strictly mandatory. That is not a criticism; it is the document's design. But it means a statement in a policy, a board pack or a client questionnaire that the firm "complies with ISO/IEC 23894" is close to meaningless, and a reader who knows the standard will read it as a signal about the firm rather than about the programme.

The correct use is internal. Guidance standards are good raw material for a risk methodology: they give a considered structure for identifying, analysing, evaluating and treating AI risk that you do not have to invent. Adopt the structure, write your own requirements on top, and let your internal method be the thing with the "shall" in it.

ISO/IEC 42005:2025

Published in 2025, on AI system impact assessment. It sits in the same conceptual space as the AI Act's fundamental rights impact assessment, a GDPR data protection impact assessment and the algorithmic impact assessments various public sector regimes require.

Its usefulness is in giving one internal process that can produce the several documents different regimes demand, rather than running three assessment exercises over the same system with three templates and three sets of interviews. That consolidation is worth real money in a firm with EU, Swiss and US exposure.

What it cannot do is set the required contents where a law does. If the Article 27 fundamental rights impact assessment applies to you, the six elements prescribed there are the required contents: the deployer's processes in which the system will be used; the period and frequency of use; the categories of persons and groups likely to be affected; the specific risks of harm to them; how human oversight measures will be implemented; and the measures to take if risks materialise, including internal governance and complaint mechanisms. A standard's template that omits one of those produces a document that is not the statutory assessment, however well structured it is.

The sequencing that works: statutory contents first, standard's structure second. Build the template from the law, then use the standard to organise the process that fills it in.

How to write about standards without overclaiming

Three sentences that appear constantly in governance documentation and should not.

"We are compliant with ISO/IEC 23894." There is nothing to comply with. Say instead that the firm's AI risk methodology is informed by it.

"Our impact assessment process follows ISO/IEC 42005, so it meets the AI Act requirement." It does not follow. The statutory contents are set by Article 27.

"We are aligned to ISO/IEC 42001." Alignment is not certification and means whatever the writer wants it to mean. Either you operate a management system and can show the Statement of Applicability, the internal audit results and the management review records, or you are using the standard as vocabulary. Both are legitimate; conflating them is not.

Worked example: a client questionnaire answered twice

A pension fund sends an asset manager a due diligence questionnaire with the question: what AI standards do you conform to?

The first draft answer reads: "The firm conforms to ISO/IEC 42001, ISO/IEC 23894 and ISO/IEC 42005, and aligns to the NIST AI Risk Management Framework." It is four claims, three of which are not capable of being true in the sense a reader will take them, and it is a written representation to a client.

The second draft reads: "The firm operates an AI management system whose structure follows ISO/IEC 42001. It is not certified; a certification decision is scheduled for the next financial year. Our AI risk methodology draws on ISO/IEC 23894, which is guidance rather than a requirements standard. Our impact assessment template is built from the statutory contents applicable to us and organised using the structure in ISO/IEC 42005. The programme is arranged under the four NIST AI RMF functions, which is voluntary and carries no enforcement."

The second answer is longer, less impressive and true. In a regulated relationship the second is worth considerably more, because the first is a sentence someone will eventually read back to you next to your actual Statement of Applicability.

As of 24 September 2026.