Technical Standards for AI: ISO, IEEE, and Standardization

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Technical standardization of artificial intelligence is advancing worldwide through ISO and IEEE standards that already affect businesses, governments, and Brazil’s own legal framework.

The Role of Technical Standardization in the Artificial Intelligence Ecosystem

Look at how quickly artificial intelligence has developed in recent years, and one thing becomes clear: disruptive technologies have created an urgent need for standardization. Technical standards serve as the foundation for interoperability, security, transparency, and reliability in these systems. Without them, every developer or company would operate by its own criteria, making independent quality verification, or accountability for failures, practically impossible.

Technical standardization of AI is not only an engineering matter. It has deep legal implications, because the regulatory frameworks that many countries are building refer directly to technical standards as a benchmark for compliance. In Brazil, the bill that governs artificial intelligence expressly mentions the adoption of internationally recognized standards as a way to demonstrate good practices. This means that lawyers, public managers, and compliance professionals need to understand how these standards work in order to advise their clients and organizations properly.

The main bodies responsible for this standardization are the ISO (International Organization for Standardization), the IEC (International Electrotechnical Commission), and the IEEE (Institute of Electrical and Electronics Engineers). Each of these organizations works within a complementary scope. Their standards are voluntary at the outset, but they often become mandatory once national legislation incorporates them or contracts and public procurement procedures require them.

ISO/IEC JTC 1/SC 42: The Global Standards Committee for AI

The leading center of international standardization for artificial intelligence is subcommittee SC 42, established in 2017 within ISO and IEC’s Joint Technical Committee JTC 1. This subcommittee is devoted exclusively to AI standardization and includes dozens of participating countries, among them Brazil, represented by the ABNT (Brazilian Association of Technical Standards). SC 42 organizes its work in groups that range from foundational concepts to specific sector applications.

Among the most relevant standards already published, ISO/IEC 22989 deserves mention. It establishes artificial intelligence concepts and terminology, creating a common vocabulary that makes communication easier among professionals from different fields. ISO/IEC 23053 describes a framework for systems that use machine learning, detailing the components, the processes, and the relationships among them. ISO/IEC 42001, published in December 2023, is particularly significant because it is a management system standard (similar to ISO 9001 and ISO 27001). It allows organizations to implement, maintain, and continually improve an artificial intelligence management system.

ISO/IEC 42001 deserves special attention from legal professionals because it sets AI governance requirements that line up directly with the demands of many laws around the world, whether pending or already enacted. The standard requires organizations to carry out impact assessments, document their AI policies, establish ongoing monitoring processes, and show that top management is committed to the responsible use of these technologies. Companies certified under this standard will have a significant advantage when they need to demonstrate regulatory compliance to authorities and courts.

Another key standard is ISO/IEC 23894, which deals specifically with artificial intelligence risk management. It adapts the general ISO 31000 framework to the AI context, recognizing that intelligent systems present particular risks (such as algorithmic bias, lack of explainability, and dependence on training data) that call for specific approaches to identification, analysis, and treatment.

IEEE’s Contributions to Ethical and Technical Standardization

While ISO/IEC concentrates on management standards and technical frameworks, the IEEE has stood out for initiatives that combine technical standards with ethical concerns. Its IEEE Global Initiative on Ethics of Autonomous and Intelligent Systems produced the document “Ethically Aligned Design,” which served as the basis for several standards in the IEEE 7000 family.

IEEE 7000-2021 (Model Process for Addressing Ethical Concerns during System Design) is a pioneer in establishing an engineering process that builds ethical considerations into every phase of the life cycle of autonomous and intelligent systems. It does not impose specific values. Instead, it provides a method for organizations to identify, prioritize, and incorporate the ethical values that matter in their own context. For legal professionals, this standard is relevant because it offers a technical reference for judging whether a company exercised ethical diligence in developing its AI systems.

The IEEE 7001 through IEEE 7014 family of standards covers topics such as transparency of autonomous systems (7001), data protection in AI processes (7002), algorithmic bias considerations (7003), child safety in intelligent systems (7010), and well-being impact assessment (7010). Although these standards originated in electrical and electronic engineering, they speak directly to legal principles such as objective good faith, the duty to inform, consumer protection, and fundamental rights.

Technical standards for AI are no longer documents reserved for engineers: today they are essential references for legislators, judges, and lawyers who must assess whether intelligent systems comply.

In addition, the IEEE Standards Association has developed certification programs and conformity marks that let organizations publicly demonstrate their adherence to these standards. This creates an independent verification ecosystem that can be used as evidence in court proceedings, regulatory audits, and public procurement procedures.

The Brazilian Landscape: ABNT, the LGPD, and the Legal Framework for AI

In Brazil, the ABNT actively follows the work of SC 42 and has already adopted several international standards as Brazilian standards (NBR). ABNT/CB-021 (Brazilian Committee on Computers and Data Processing) and study commission CE-021:000.042 are the bodies responsible for this work. Brazil’s participation in drafting these international standards helps ensure that the particularities of its legal system and its socioeconomic reality are taken into account.

The interaction between technical standards and Brazil’s regulatory framework occurs at multiple levels. The LGPD (Brazil’s General Data Protection Law, Law 13.709/2018) already provides, in Article 46, that processing agents must adopt security measures “capable of protecting personal data,” without specifying which ones. Technical standards such as ISO/IEC 27701 (privacy management) and ISO/IEC 42001 (AI management) fill that gap by offering objective benchmarks for assessing whether the measures adopted are adequate. In court disputes involving data processing by AI systems, compliance with these standards can be decisive in determining fault or in establishing grounds that exclude liability.

The AI regulation bill under discussion in Brazil’s National Congress takes a risk-based approach that closely mirrors the international technical frameworks. The text provides that high-risk AI systems must undergo conformity assessments, and those assessments are very likely to use ISO/IEC technical standards as a reference. This means that companies that adopt these standards early will be better positioned when the regulation takes effect.

INMETRO (Brazil’s National Institute of Metrology, Quality, and Technology), as the Brazilian body responsible for accrediting certification bodies, will also play a central role in putting these standards into practice. The certification infrastructure that already exists for areas such as quality (ISO 9001) and information security (ISO 27001) could be adapted to include AI certifications, creating a compliance ecosystem that benefits both businesses and consumers.

Practical Implications for Businesses and Legal Professionals

The convergence of technical standards and legal regulation creates concrete opportunities and challenges for many players. Companies that develop or use AI systems should treat implementing a management system under ISO/IEC 42001 as a strategic priority. Beyond reducing regulatory risk, certification under this standard shows a commitment to good practices and can be a competitive advantage in public procurement, business partnerships, and investor relations.

For legal professionals, knowing these technical standards is becoming an essential skill. In litigation over harm caused by AI systems, analyzing compliance with ISO and IEEE standards can support either the claim or the defense. An expert who evaluates how well a system adheres to risk management standards (ISO/IEC 23894) or transparency standards (IEEE 7001) gives the judge objective elements for reaching a decision, overcoming the subjectivity that so often colors discussions of complex technologies.

In public administration, government agencies that contract for AI solutions (for example, to screen social security benefits, detect fraud, or automate administrative processes) can and should include in their bidding documents a requirement to comply with the relevant technical standards. This not only protects the public interest but also sets objective evaluation criteria that reduce discretion and strengthen transparency in public contracting.

Technical standards also offer a path toward sector self-regulation. Business associations and professional councils can adopt codes of conduct based on ISO and IEEE standards, creating governance mechanisms that complement state regulation. This approach, known as “co-regulation,” is expressly provided for in several legislative proposals on AI and can speed up the adoption of good practices without relying solely on government action.

In conclusion, technical standardization of artificial intelligence is an interdisciplinary field that legal professionals can no longer ignore. ISO, IEC, and IEEE standards may be technical in nature, but their legal consequences are direct and growing. Following how they evolve, understanding their requirements, and advising clients on adopting them are skills that will set apart the professionals who are ready for the regulatory challenges now rapidly taking shape.

This subject is directly related to API economy and, a topic we cover in a dedicated article.

To complement your reading, see also the article on legal obligation.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.