Governance vs Management in ISO/IEC 38500 & 38507

The ISO/IEC 38500 family of standards provides the international reference framework for the governance of information technology and related domains. The foundational document, ISO/IEC 38500:2024 (Information technology - Governance of IT for the organization - Second edition), defines the principles and model for governance of IT. It is complemented by ISO/IEC 38507:2022 (Information technology - Governance of IT - Governance implications of the use of artificial intelligence by organizations), which applies the same governance model specifically to AI, and ISO/IEC 38505:2017 (Governance of data). Together, these standards clearly distinguish between governance (the responsibility of the governing body) and management (the responsibility of executive management). This distinction is central to effective oversight of IT, data, and AI systems and has influenced modern frameworks, including ISO/IEC 42001 (AI management systems) and the EU AI Act's Quality Management System requirements.

Conceptual Foundation in ISO/IEC 38500:2024 and ISO/IEC 38507:2022

ISO/IEC 38500:2024 defines governance of IT as 'the system by which the current and future use of information technology is directed and controlled.' It emphasizes that governance is a governing body responsibility, while management is an executive responsibility. ISO/IEC 38507:2022 applies the same model to AI, stating that the governing body is responsible for the governance implications of AI use within the organization. The standards consistently separate the two concepts as follows:

Governance is the system by which the organization's current and future use of IT/AI is directed, evaluated, and monitored. It involves setting direction, approving policy, ensuring alignment with organizational objectives, evaluating performance, and monitoring outcomes.
Management is the system by which plans are prepared, resources are built and run, and day-to-day operations are executed to achieve the direction set by governance.

The standards stress that the governing body cannot delegate its governance responsibility - it retains ultimate accountability to stakeholders - but it must delegate operational management to executives. The separation concerns roles, decision rights, and accountability, not necessarily separation of individuals.

Key Differences: Governance vs Management in the ISO/IEC 38500 Suite

The following table summarises the primary distinctions as articulated in ISO/IEC 38500:2024 and ISO/IEC 38507:2022:

Aspect	Governance (Governing Body's Role)	Management (Executive Role)
Primary Focus	Direction, evaluation, monitoring	Planning, building, running
Level	Strategic / oversight	Tactical / operational
Key Activities	Approve IT/AI strategy & policy; ensure alignment with enterprise objectives; evaluate performance & value delivery; oversee risk appetite & major investments; monitor compliance, risks & outcomes; hold management accountable	Develop and execute IT/AI plans; manage day-to-day operations; implement controls & processes; deliver projects & services; manage risks within delegated authority; report performance & incidents to the governing body
Accountability	Governing body is ultimately accountable to stakeholders for IT/AI governance	Management is accountable to the governing body for execution and results
Delegation	Cannot delegate governance responsibility	Governing body delegates operational management to executives

Practical Application in IT, Data, and AI Contexts

The ISO/IEC 38500 suite applies the governance-management distinction consistently across IT, data, and AI domains:

Governing Body (Governance):

Approves enterprise IT/data/AI strategy, policies, and major investments;
Sets risk appetite and tolerance for IT/data/AI-related risks;
Ensures alignment with organizational objectives and value creation;
Evaluates performance, value delivery, and compliance through regular assurance;
Monitors emerging risks (e.g., data breaches, algorithmic bias, AI safety incidents).

Management (Execution):

Develops and implements IT/data/AI policies, plans, processes, and controls;
Manages day-to-day operations, security, data quality, model development, deployment, monitoring, and maintenance;
Executes risk management processes within the governing body-approved appetite;
Delivers projects, manages suppliers/partners/third parties;
Reports performance, incidents, and emerging issues to the governing body.

Example in AI context: The governing body approves an enterprise AI governance policy, risk appetite, and major AI investment decisions (governance); management develops the AI management system per ISO/IEC 42001, implements life-cycle controls, manages data governance per ISO/IEC 38505, executes model development/deployment/monitoring, and reports quarterly to the governing body on AI performance, risks, and value (management).

Edge Cases and Nuances in the Governance-Management Distinction

Key nuances and edge cases:

Small and medium-sized organizations: The same individuals may perform both roles, but the standards require clear delineation of decision rights - strategic vs. operational - and documented separation to maintain effective oversight and avoid conflicts.
High-risk AI systems (EU AI Act context): Article 17 requires top-management commitment and accountability (governance) while delegating operational implementation of the QMS elements (management) - fully aligned with ISO/IEC 38500 and 38507.
Data governance (ISO/IEC 38505): The governing body sets data value, risk, and ethical policy; management executes data classification, quality controls, stewardship, and compliance processes.
Third-party / outsourced IT/data/AI: Governance remains with the governing body (oversight of supplier risk, value, and alignment); management is delegated to executives who monitor supplier performance, compliance, and service delivery.

Common failure modes include the governing body delegating too much (losing effective oversight) or micromanaging operations - both violate the ISO/IEC 38500 balance and increase risk exposure.

Strategic Implications and Influence on Modern Frameworks

The ISO/IEC 38500 suite's governance-management distinction profoundly influences contemporary governance and management standards:

ISO/IEC 42001 (AI Management Systems): Requires separation of governance (top management policy, oversight, accountability) from management (process execution, operational control), with documented roles, process owners, and life-cycle management.
EU AI Act Article 17 QMS: Demands top-management commitment and accountability (governance) while delegating operational implementation of the 13 QMS elements (management) - mirroring the ISO/IEC 38500 model.
Data Governance (ISO/IEC 38505): Extends the distinction to data assets, with the governing body setting data value/risk/ethics policy and management executing stewardship, quality, and compliance controls.

Strategic implication: Organizations that consistently apply the ISO/IEC 38500 governance-management distinction build robust, defensible accountability structures - reducing legal, ethical, operational, and reputational risk while enabling scalable, responsible deployment of IT, data, and AI systems.

Summary

In summary, the ISO/IEC 38500 suite (particularly 38500:2024 and 38507:2022) clearly distinguishes governance (governing body direction, evaluation, and monitoring) from management (executive planning, building, and running). This separation ensures strategic direction and risk appetite are set at the highest level while operational responsibility is delegated - a foundational principle that remains central to effective governance of IT, data, and artificial intelligence in modern organizations.