Plain answer

Does ISO 27091 apply to my organization?

It is aimed at any organization of any size that develops or uses AI systems, including government and not-for-profit organizations. If your AI system processes personal data, the privacy question it describes is already your question.

The stated population

The abstract reaches organizations of every size and kind, naming private firms, public bodies, government and not-for-profit organizations among those that build AI systems or use them. It does not limit itself to developers or to one sector.

The trigger

The subject is privacy risk in AI systems and machine learning models. The practical trigger is personal data anywhere in the lifecycle: training data, fine tuning data, prompts, retrieved records, outputs, logs or human review.

The role question

Whether you are a controller, a processor or both decides which privacy duty follows. A company that trains on its own customer data and also hosts a model for a client is both, and the two roles need separate answers. The reference page on role names the question from ISO/IEC 27701.

The test

List the AI systems in use, mark which ones touch personal data, and mark which lifecycle stages you control. The free check applies that reasoning and returns incomplete, rather than a lighter answer, when a fact is missing.