ISO/IEC 24029 Robustness of Neural Networks (TR 24029-1:2021 and 24029-2:2023)

Applies To

Overview

ISO/IEC 24029, Artificial intelligence, Assessment of the robustness of neural networks, is a multi-part standard developed by ISO/IEC JTC 1/SC 42 (the joint international standards committee on AI). Part 1, ISO/IEC TR 24029-1:2021, is a Technical Report published in March 2021. It gives informative background on robustness concepts and existing methods for assessing the robustness of neural networks. Here, robustness means how well a system keeps working correctly when its inputs are unusual, noisy, or manipulated. Part 2, ISO/IEC 24029-2:2023, is an International Standard giving methodology for using formal methods to verify robustness, meaning mathematical techniques that prove or limit how a network behaves when inputs change within defined bounds. The series addresses a known weakness of deep learning systems: tiny input changes, deliberate or accidental, can cause wrong answers even when the input's meaning is unchanged. This brittleness has direct safety and security implications in high-stakes deployment contexts including autonomous vehicles, medical image analysis, fraud detection, and critical infrastructure management. Part 1 sets out a classification of robustness threats (adversarial examples crafted to fool a model, distributional shift when real data drifts from training data, data corruption, and model poisoning through tampered training data). It also describes three categories of assessment method: empirical testing, formal verification, and statistical assessment. Part 2 puts formal verification into practice, detailing mathematical techniques (satisfiability-based, abstract interpretation, and Lipschitz-bound methods) that can prove robustness for a specified range of inputs. Together, the parts provide a layered assessment toolkit scalable to the risk level and technical constraints of the deployment context. ISO/IEC 24029 is technically complementary to ISO/IEC 24028 (trustworthiness), ISO/IEC 23894 (risk management), and the safety-specific guidance in ISO/IEC TR 5469 (functional safety and AI systems). It is referenced in the EU AI Act's harmonized standards workplan as a tool supporting conformity assessment (checking that a system meets the Act's requirements) for high-risk AI systems.

Key Requirements

• •Part 1 defines robustness in the ANN context as the degree to which a neural network maintains correct and intended behavior when subject to input perturbations, distributional shifts, or adversarial manipulation.
• •Part 1 provides a structured taxonomy of robustness threats, enabling organizations to scope and prioritize robustness assessment activities in proportion to deployment risk.
• •Part 1 describes three categories of robustness assessment methodology, empirical testing, formal/mathematical verification, and statistical approaches, and provides selection criteria based on system criticality and available resources.
• •Part 2 specifies formal verification methods including satisfiability modulo theories (SMT), abstract interpretation, mixed-integer linear programming (MILP), and Lipschitz continuity bounding for neural network robustness proofs.
• •Part 2 defines the scope conditions under which formal robustness guarantees are valid, including input space constraints, network architecture requirements, and property specification formats.
• •Organizations are guided to document robustness assessment scope, methods selected, perturbation budgets, and results in a manner that supports technical file requirements under AI regulations.
• •The standard recommends integration of robustness assessment into the AI system development lifecycle rather than as a post-deployment afterthought.
• •Guidance is provided on interpreting robustness assessment results in terms of operational risk, supporting risk-tiered governance and deployment-decision processes.

What Your Organization Must Do

• →Map which of your neural network systems face unusual, noisy, or manipulated inputs in real use.
• →Use Part 1's threat list to scope robustness testing in proportion to deployment risk.
• →Choose assessment methods from empirical testing, formal verification, or statistical approaches, and record why.
• →Document assessment scope, methods, perturbation budgets, and results to support technical files under AI regulations.
• →Feed robustness findings into risk management work aligned with ISO/IEC 23894 and ISO/IEC TR 5469.
• →Treat alignment as voluntary, since the standard imposes no legal duty on its own.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Is ISO/IEC 24029 compliance mandatory for EU AI Act high-risk systems?

ISO/IEC 24029 is not directly mandatory, but it is referenced in the EU AI Act harmonized standards workplan as a technical instrument supporting conformity assessment for high-risk AI systems. Aligning with it strengthens a technical file and reduces conformity assessment friction with notified bodies.

What is the difference between ISO/IEC 24029 Part 1 and Part 2?

Part 1 (2021) establishes robustness terminology, threat taxonomy, and a framework for selecting assessment approaches. Part 2 (2023) operationalizes formal mathematical verification methods, including SMT, abstract interpretation, MILP, and Lipschitz bounding, for producing provable robustness guarantees within defined input regions.

Which sectors face the most direct compliance pressure from ISO/IEC 24029?

Healthcare AI (medical imaging), autonomous vehicles, financial services fraud detection, and critical infrastructure operators face the most direct pressure, given that these sectors overlap heavily with the EU AI Act high-risk categories and with regulatory regimes that require documented evidence of system resilience to adversarial inputs.

How does ISO/IEC 24029 relate to ISO/IEC 23894 and ISO/IEC TR 5469?

ISO/IEC 24029 provides the robustness-specific assessment layer within a broader ISO AI governance stack. ISO/IEC 23894 addresses AI risk management more broadly, while ISO/IEC TR 5469 covers functional safety. Robustness assessment outputs from 24029 should feed directly into the risk treatment and safety analyses required by those companion standards.

Can empirical testing alone satisfy ISO/IEC 24029 requirements for a high-risk neural network?

Part 1 permits empirical testing as a valid methodology, but Part 2 and the standard's risk-tiered guidance indicate that formal verification is expected for high-criticality systems where provable guarantees are feasible. Relying solely on empirical testing for a high-risk EU AI Act system is likely to be insufficient for a notified body submission.

What documentation does ISO/IEC 24029 require organizations to produce?

Part 1 is an informative Technical Report and requires nothing. Part 2 gives methodology for formal verification, so recording the threat scope, methods chosen, and proof conditions is good practice for technical files.