One page per clause
The requirement in our words, the evidence an assessor asks for, the common gaps and what to do before publication.
Open the registerDoes ISO 42703 apply to your AI system?
It applies to any algorithmic system used in selection, allocation, ranking or decision-making where different parties can receive different outcomes, whatever the technology. It also applies when a system is designed, used with new data, moved to a new context, updated or decommissioned. A system that cannot produce different outcomes is outside it.
Last updated: . Written from the published source and the ISO record. Not legal advice; does not certify.
The test is the outcome, not the technology
The standard is agnostic to the computational approach. A rules engine that decides who gets a benefit, a statistical score that ranks applications and a machine learning model that flags risk are all in scope if different parties can receive different outcomes. Calling a system a rules engine is not a way out.
The five trigger events
A system enters the process when it is designed, when it is used with data different from its training data, when it is deployed in a new context, when it is updated, and when it is decommissioned. The last one surprises teams. A retirement decision can affect people who relied on the system, so the bias record still matters.
What takes a system out of scope
A system that cannot give different outcomes to different parties is outside the field of application. So is a system that is never designed, changed, moved, updated or retired, which is rare. A system used only for a purpose the standard excludes may still be covered by another law, but this standard's process does not apply.
What to do next
Write the scope note for each system: the decisions, the parties, the five triggers and the boundary. Then run the free check. If the answer is unsure, the check returns scope incomplete and names the question rather than guessing the lighter pathway.
Related clauses
Questions
Does a purely rule-based system count?
Yes. The standard applies whatever the computational approach. The question is whether the system can give different outcomes to different parties, not whether it uses machine learning.
Does a system in decommissioning still count?
Yes. Decommissioning is one of the trigger events, because the wind-down can affect the people who relied on the system.
What if I am only a procurer, not the creator?
The standard is written for the people who create the system, and it names procurers in its audience. A procurer can hold a supplier to the standard in a contract, and it still owns the context of use and the acceptance of risk.
Run the free scope check / Open the register / The kit and the watch
THE RULES THIS IS BUILT FROM
The rules this is built from
Read from the real rules, not invented. Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 67 records, 269 evidence lines and 201 common failure lines. The dates come from the ISO record. The substance comes from the published IEEE edition behind the joint project.
61 CLAUSES
6 ANNEXES
Guidance, clearly labelled
Annexes A to F are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 40.99 is recorded on 16 September 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe ISO draft text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.