Public record
What ISO has published, and what it has not.
The public record
Two facts, one date, and an honest boundary.
The draft is in the approval phase. ISO records stage 50.00 on 29 September 2026, edition 1, committee ISO/IEC JTC 1/SC 42, ICS 35.240.01. The next recorded step is 50.20, an eight week ballot. The lifecycle below is the whole public clock, and it is what the dated plan is built from.
- 10.9912 February 2025New project approved
done - 20.0021 July 2025New project registered in TC/SC work programme
done - 20.2018 March 2026Working draft study initiated
done - 20.6014 April 2026Close of comment period
done - 30.005 May 2026Committee draft registered
done - 30.208 May 2026CD consultation initiated
done - 30.604 July 2026Close of comment period
done - 30.9911 September 2026CD approved for registration as DIS
done - 50.0029 September 2026Final text received or FDIS registered for formal approval
current - 50.20not recordedProof sent to secretariat or FDIS ballot initiated: 8 weeks
next - 60.00not recordedInternational Standard under publication
future - 60.60not recordedInternational Standard published
future
What ISO has published
- The designation, title, edition and stage history
- The committee, the ICS and the sustainable development goals
- An abstract that names the three subjects the guidance covers
- The stage codes that define what 50.00 and 50.20 mean
What it has not published
- The clause text, including every requirement and recommendation
- The clause and annex titles beyond the abstract
- The page count and the ballot close date
- Any publication date, national adoption or transition arrangement
The record says "not stated in the text" where this matters. It does not fill the gap from memory or from someone else's summary.
Free check
Five answers. One planning reading. Nothing stored.
Free scope and date check
Where you stand before the draft publishes.
The check reads your part in generative AI, your ISO/IEC 42001 position, your risk method and two dates against the record. It returns one of five readings and names a missing answer rather than guessing. It never returns a compliance score.
The record
92 requirement pages, each cited.
The requirement record
One page for every published requirement the draft's scope touches.
The draft's stated subjects are risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. The published standards that carry that work are ISO/IEC 23894:2023 for the risk process and ISO/IEC 42001:2023 for the AIMS controls. This site records both in our own words, one page per clause and per Annex A control, with the evidence an auditor samples and the test you can run yourself.
| Group | Published in | Pages |
|---|---|---|
| Principles | ISO/IEC 23894:2023 | 1 |
| Framework: leadership, integration and improvement | ISO/IEC 23894:2023 | 12 |
| Risk management process | ISO/IEC 23894:2023 | 22 |
| Annex A: AI-related objectives | ISO/IEC 23894:2023 | 11 |
| Annex B: AI-related risk sources | ISO/IEC 23894:2023 | 7 |
| Annex C: the AI system life cycle | ISO/IEC 23894:2023 | 1 |
| A.2 Policies related to AI | ISO/IEC 42001:2023 | 3 |
| A.3 Internal organisation | ISO/IEC 42001:2023 | 2 |
| A.4 Resources for AI systems | ISO/IEC 42001:2023 | 5 |
| A.5 Assessing impacts of AI systems | ISO/IEC 42001:2023 | 4 |
| A.6 AI system life cycle | ISO/IEC 42001:2023 | 9 |
| A.7 Data for AI systems | ISO/IEC 42001:2023 | 5 |
| A.8 Information for interested parties | ISO/IEC 42001:2023 | 4 |
| A.9 Use of AI systems | ISO/IEC 42001:2023 | 3 |
| A.10 Third-party and customer relationships | ISO/IEC 42001:2023 | 3 |
What changes
The draft adds guidance, it does not replace the AIMS.
What the draft changes
Guidance under the existing risk work, not a new certificate.
What it adds
- A generative AI specific reading of risk identification, so the risk sources named are those that generative systems bring.
- The stakeholders who face those risks across the life cycle, named rather than left to the organisation to infer.
- Guidance on risk analysis and risk treatment for generative AI, which is the part an AIMS audit tests through the risk assessment and treatment records.
- Controls aimed at the risks the guidance identifies, which an organisation can compare with the control set it already holds.
What it does not do
- It is not a management system standard, so an organisation cannot be certified against it and no certification body can issue a certificate to it.
- It is not a revision of ISO/IEC 42001:2023. The AIMS requirements stay as they are, and the draft is guidance that sits under the risk work the AIMS already requires.
- It is not in force. At stage 50.00 the text is in the approval phase and can still change before publication.
- It does not replace ISO/IEC 23894:2023, which remains the published guidance on managing AI risk.
The practical consequence: an organisation with a 42001 AIMS does not start again. It checks that its risk criteria, its impact assessment and its control evidence would survive a question framed by generative AI. That is what the 92 pages and the kit are for.
Paid
USD 799 one off, USD 49 a month.
The working products
A register you can run, and a watch that tells you the day it changes.
The kit, USD 799 one off
All 92 requirements as a register with an owner column, a due date, an evidence pointer and the clause citation. The dated plan, the evidence list and the source sheet, as PDF for the committee, CSV for your system and XLSX for the register.
The watch, USD 49 a month
An email when the ISO stage, stage date, title, committee or a recorded date changes, and when the requirement record is refreshed after publication. The email carries the diff. No marketing, and it stops when you cancel.
Questions
What buyers ask first.
Questions
What buyers ask first.
What is ISO/IEC DTS 25568?
It is a draft Technical Specification from ISO/IEC JTC 1/SC 42 on addressing risks in generative AI systems. ISO records it as edition 1 at stage 50.00, the approval phase. Its published scope covers the objectives of generative AI systems when risks are identified, the risk sources and the stakeholders exposed to them, and guidance on risk analysis, risk treatment and controls.
Can we be certified against ISO/IEC DTS 25568?
No. It is guidance, not a management system standard, and no certification scheme exists for it. ISO/IEC 42001:2023 remains the certifiable AI management system standard. The draft is read as guidance under the risk work that 42001 already requires.
What is the date on this site?
The site uses 17 February 2027 as a planning date. It is an estimate, 120 days from the build date, derived from ISO stage 50.00 on 29 September 2026. ISO has not announced a publication date, and the site says so on every page that carries the date.
Does ISO/IEC DTS 25568 replace ISO/IEC 42001 or ISO/IEC 23894?
No. ISO/IEC 42001:2023 stays the certifiable AIMS and ISO/IEC 23894:2023 stays the published AI risk management guidance. The draft adds generative AI specific guidance on risk identification, analysis, treatment and controls, which an organisation reads into the method it already runs.
Why does the site show requirements from two other standards?
Because the draft's clause text is not published. ISO publishes the draft's status and its scope, not its wording. Rather than invent it, the site records the two published standards that the stated scope builds on, in our own words, cited to the clause, with the evidence an auditor samples. When the draft publishes, the record is rebuilt.
What is in the USD 799 kit?
The full register of 92 published requirements with an owner, a due date, an evidence pointer and the clause citation, plus the dated plan and the evidence list, as PDF, CSV and XLSX. One payment, no subscription.
What does the USD 49 a month watch do?
It emails you when the ISO stage, the stage date, the title, the committee or a recorded date changes, and when the requirement record is refreshed. The refresh script diffs the public record against the data file and the email carries the diff.
The rules
Where every line comes from.
The rules this is built from
Two published standards, named, with the counts.
The requirement pages are written from ISO/IEC 42001:2023 (38 Annex A controls) and ISO/IEC 23894:2023 (54 units across clauses 4 to 7 and Annexes A to C). Each page states the requirement in our words, cites the clause and lists the evidence an auditor samples. The 160 evidence artefacts come from the same published text.
Read from the real rules, not invented. Check any line against the source link on the page, and read the method at Method. The draft's own text is not published, so it is not stated.
Who wrote this
Gerard Blokdyk, The Art of Service.
Who wrote this
A record you can check, line by line.
I build compliance records that state each requirement in plain English and point to the clause behind it. This record was written from the official ISO record and the published text of the two standards named above on 20 October 2026. It is not affiliated with ISO or IEC, and it does not certify anyone.