Normative references

Public text. This clause is public in the draft. The statement below is ours and the clause number is the citation; the official wording is the one to check against.

What it says, in our words

The normative references are the documents whose content is required to apply this one. This draft names two: ISO/IEC 22989:2022 for artificial intelligence concepts and terminology, and ISO/IEC 27005:2022 for the management of information security risk. Dated references apply as the edition cited. Undated references apply as the latest edition, including amendments.

What it means for an ISMS manager

Two references is a short list and it tells you how the document is meant to be used. The risk process comes from 27005:2022, so clause 7 is a big data lens on a process an ISMS manager already runs, not a second risk method. The AI vocabulary comes from 22989:2022, so the document does not define AI for itself and does not need the reader to agree a new glossary. Check the reference list in your own method and supplier documents. A list that still shows 27005 alone is out of date against this draft, and a list that cites an older 22989 edition will not match the terms this document uses. When the standard is published, re-read the list before you re-baseline: a normative reference can be added or dated between the draft and the published edition.

What changed in this unit

• Clause 2: ai reference. ISO/IEC 22989:2022 is a normative reference alongside ISO/IEC 27005:2022.

What an auditor samples

• The current reference list from the risk method, with the edition and year for each entry.
• The controlled copies of ISO/IEC 27005:2022 and ISO/IEC 22989:2022, or the subscription that gives access to them.
• A note showing which clauses of your method depend on each reference.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.