SOURCES
The sources behind every line
There are three kinds of source here, and the pages say which one a line comes from: the published standard that applies today, the public record of the 27091 draft, and the instruments named for the four markets. The standards are not reproduced. The 27091 text is not public and is not reproduced.
| Source | Kind | What it is used for | Link |
|---|---|---|---|
| ISO/IEC FDIS 27091, Cybersecurity and Privacy, Artificial Intelligence, Privacy protection ISO | official record | Edition 1, 35 pages, ISO/IEC JTC 1/SC 27, ICS 35.030 and 35.240.01, stage 50.00 on 2026-07-13. The page publishes the abstract, the general information and the full stage history, and does not publish the draft text. | Open 2026-10-22 |
| ISO stage feed for 56582 ISO | machine-readable stage record | Carries the stage, its date, the committee and the ICS; the refresh script reads it and fails on a change. | Open 2026-10-22 |
| ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system ISO, read at the standards library | control record | The Annex A control set, stated in our own words with the control cited: 38 AI management controls, their evidence and their common gaps. This is the requirement layer of the site. | Open 2026-10-22 |
| ISO/IEC 27701:2025, Security techniques, Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management ISO, read at the standards library | control record | Used for the controller and processor role determination and for the privacy duties that sit beside the AI controls. Named on the reference pages; the control pages cite 42001. | Open 2026-10-22 |
| ISO/IEC 22989:2022, Artificial intelligence, Concepts and terminology ISO, public view | published standard, public view | Used for the AI system life cycle stage names and for the definition of an AI system. Public view, read on the build date. | Open 2026-10-22 |
| ISO/IEC 23894:2023, Artificial intelligence, Guidance on risk management ISO | published guidance | Named for the risk management vocabulary used on the treatment pages. The site does not reproduce it. | Open 2026-10-22 |
| United States: the instruments named on the reference page US Government and state legislatures | named jurisdictions | Named only: the FTC Act, sector statutes, state privacy laws and state AI rules, with the NIST AI RMF as the voluntary framework. No statute is stated on this site; the link is to the NIST framework page because the FTC pages refuse a scripted client. | Open 2026-10-22 |
| European Union: the instruments named on the reference page European Union | named jurisdictions | Named only: the GDPR and the AI Act, Regulation (EU) 2024/1689, with national implementations. No text is stated on this site. | Open 2026-10-22 |
| United Kingdom: the instruments named on the reference page UK Government and the ICO | named jurisdictions | Named only: the UK GDPR, the Data Protection Act 2018 and ICO guidance on AI. No text is stated on this site. | Open 2026-10-22 |
| Australia: the instruments named on the reference page Australian Government and the OAIC | named jurisdictions | Named only: the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Notifiable Data Breaches scheme and state law. No text is stated on this site. | Open 2026-10-22 |
Guidance in the same family, named only
ISO/IEC 27090 (AI security), ISO/IEC 23894 (AI risk management), ISO/IEC 22989 (AI concepts and terminology), ISO/IEC 25059 (AI quality model), ISO/IEC 27001 (information security management) and ISO/IEC 27701 (privacy information management) stand around the same subject. They support topics the 27091 record touches, but this product does not reproduce them. They are named here so a reader knows where the guidance stops and the control begins. See the ISO catalogue.
How the sources are used
- The requirement today is written from our ISO/IEC 42001:2023 Annex A record, with the control cited. The evidence and the common gaps come from the same record.
- The public record is the ISO stage page and its feed. They give the designation, the stage, the dates, the committee, the page count and the abstract.
- The lifecycle stages are named from ISO/IEC 22989:2022, a published terminology standard.
- The law is named from the instruments on the reference pages. No statute is stated.
- The dates are from the ISO stage record. The planning date is the reader's estimate, labelled. No 27091 transition document exists and none is claimed.
If a source changes. The refresh script re-downloads the stage feed, diffs it against the record and fails loudly on a change. That diff is what the change watch sends. A correction is made in the record and regenerates every page, not patched on one page.
Last updated: .