ISO/IEC TR 24028:2020, Overview of Trustworthiness in Artificial Intelligence

Applies To

Overview

ISO/IEC 24028:2020, Information technology, Artificial intelligence, Overview of trustworthiness in artificial intelligence, is a Technical Report, an informative document rather than a standard with requirements, published by ISO/IEC JTC 1/SC 42 on 28 May 2020. It surveys approaches to assess and achieve availability, resiliency, reliability, accuracy, safety, security, and privacy in AI systems. The document does not prescribe specific technical methods. Instead, it sets a shared baseline of concepts and terms that later SC 42 standards build on to address specific aspects of trustworthy AI. ISO/IEC 24028 maps threats and risks to trustworthiness across the AI system lifecycle, from data collection and model training through deployment and ongoing operation. It also identifies the organizational, technical, and process-level measures that contribute to trustworthiness. The standard covers AI systems built on machine learning (software that learns patterns from data) and those that are not. It serves several audiences: technical practitioners designing AI systems, organizations deploying AI, conformity assessment bodies (independent auditors and certifiers), and policymakers aligning regulation with technical standards. ISO/IEC 24028 is explicitly cross-referenced in the EU AI Act's standardization workplan and in documentation for the US National Institute of Standards and Technology AI Risk Management Framework (NIST AI RMF). It is also cited in the OECD AI Principles implementation guidance, giving it significance beyond purely technical communities. It should be read alongside ISO/IEC 22989 (AI concepts and terminology), ISO/IEC 23894 (AI risk management), and ISO/IEC 42001 (AI management systems) as part of SC 42's integrated standards family.

Key Requirements

• •Surveys approaches to assess and achieve availability, resiliency, reliability, accuracy, safety, security, and privacy in AI systems.
• •Identifies and categorizes threats to AI trustworthiness across the full system lifecycle, including data poisoning, model evasion, distribution shift, and adversarial attacks.
• •Describes measures, technical, organizational, and process-based, that contribute to each trustworthiness property.
• •Provides guidance on documenting trustworthiness-related decisions and trade-offs, supporting auditability and explainability obligations in downstream regulation.
• •Establishes a mapping between trustworthiness properties and stakeholder concerns, enabling risk-tiered governance approaches.
• •Identifies human oversight and accountability structures as prerequisites for trustworthy AI deployment.
• •Addresses the role of transparency and explainability as enabling conditions for trustworthiness, particularly in high-stakes automated decision contexts.
• •Provides a reference framework that organizations can use to benchmark internal AI governance programs against internationally recognized trustworthiness criteria.

What Your Organization Must Do

• →Treat ISO/IEC 24028 as voluntary guidance, not a certifiable standard with binding duties.
• →Map your AI governance program against the report's trustworthiness properties: availability, resiliency, reliability, accuracy, safety, security, privacy.
• →Adopt the report's shared vocabulary in internal policies so teams describe trustworthiness consistently.
• →Add the trustworthiness properties to vendor questionnaires and ask suppliers how they address each one.
• →Document trustworthiness decisions and trade-offs using the report's guidance to support later audits.
• →Read it alongside ISO/IEC 22989, ISO/IEC 23894 and ISO/IEC 42001, which carry certifiable requirements.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Is ISO/IEC 24028 a certifiable standard or a guidance document?

It is a Technical Report, so it is informative guidance and cannot be certified against. Certifiable requirements come from related standards such as ISO/IEC 42001 on AI management systems.

How does ISO/IEC 24028 relate to the EU AI Act's conformity requirements?

The EU AI Act's standardization workplan explicitly cross-references ISO/IEC 24028, meaning harmonized standards developed under that workplan are expected to align with its trustworthiness framework. Organizations demonstrating alignment with ISO/IEC 24028 properties will be better positioned when harmonized technical standards for high-risk AI systems are finalized.

What are the nine trustworthiness properties defined in ISO/IEC 24028?

The report does not set a fixed list of nine. Its scope covers availability, resiliency, reliability, accuracy, safety, security, and privacy. Fairness is not among them, and robustness is treated as part of verifying trustworthiness.

Does ISO/IEC 24028 cover non-machine-learning AI systems?

Yes. The standard explicitly addresses both ML-based and non-ML-based AI systems, making it applicable across a broader range of deployed technologies than frameworks focused solely on deep learning or statistical models.

How does ISO/IEC 24028 fit within the broader SC 42 standards family?

ISO/IEC 24028 functions as a foundational reference document within SC 42's integrated suite. It should be read alongside ISO/IEC 22989 (AI concepts and terminology), ISO/IEC 23894 (AI risk management), and ISO/IEC 42001 (AI management systems), which together form a coherent governance architecture for enterprise AI programs.

Can organizations use ISO/IEC 24028 in AI vendor procurement and due diligence?

Yes, its trustworthiness properties, such as safety, security, and privacy, give vendor checklists a common vocabulary. Procurement teams can ask suppliers to show how they address them.