Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).

ISO and IEC draw attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.

This document was prepared jointly by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittees SC 7 Software and systems engineering and SC 42, Artificial intelligence.

A list of all parts in the ISO/IEC 42119 series can be found on the ISO and IEC websites.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

This document facilitates understanding of how ISO/IEC/IEEE 29119-1, ISO/IEC/IEEE 29119-2, ISO/IEC/IEEE 29119-3, ISO/IEC/IEEE 29119-4 and ISO/IEC 20246 apply to the testing of AI systems.

The purpose of ISO/IEC/IEEE 29119 (all parts) is to define an internationally agreed set of standards for software testing that can be used by any organization when performing any form of software testing.

ISO/IEC/IEEE 29119-1 introduces software testing concepts, which can be applied to any AI system.

ISO/IEC/IEEE 29119-2 comprises test process descriptions that define the software test processes at the organizational level, test management level and dynamic test levels. It supports dynamic testing, functional and non-functional testing, manual and automated testing and scripted and unscripted testing, and can be utilized for the testing of any software-based system, including AI systems.

ISO/IEC/IEEE 29119-3 defines software test documentation. The requirements specified for templates and examples of test documentation defined in ISO/IEC/IEEE 29119-3 can be met in the test documentation for any AI system.

ISO/IEC/IEEE 29119-4 defines test design techniques, which can be utilized for the testing of AI systems and their components.

ISO/IEC 20246 defines processes and templates for work product reviews, including inspections, walkthroughs and technical reviews.

This document explains how ISO/IEC/IEEE 29119-2 can be adopted for the testing of AI systems and their components and how the test documentation templates defined in ISO/IEC/IEEE 29119-3 can be implemented when testing AI systems and their components. This document also explains how ISO/IEC 20246 can be adopted for the review of AI systems and related documentation. This document is structured as follows:

Clauses 1 to 4 define the scope, normative references, terms and definitions and abbreviated terms;
Clause 5 defines concepts of AI system architectures, the AI system life cycle and testing processes and documentation;
Clause 6 explains how risk is identified for AI systems;
Clause 7 defines test approaches suitable for testing AI systems and components;
Annexes A to C provide supporting details and examples.

The aim of the ISO/IEC 42119 series is to provide requirements and guidance on the testing of AI components and systems.

Other parts of the ISO/IEC 42119 series include:

ISO/IEC TS 42119-3 describes approaches and provides guidance on processes for the verification and validation analysis of AI systems;
ISO/IEC TS 42119-7 provides technology-agnostic guidance for conducting red teaming assessments on AI systems;
ISO/IEC TS 42119-8 provides definitions, concepts, requirements and guidance related to assessing prompt-based text-to-text AI systems that utilize generative AI.

1 Scope

This document provides requirements and guidance on the application of the ISO/IEC/IEEE 29119 series to the testing of AI systems. This document follows a risk-based approach and uses risks associated with AI systems, and their development and maintenance, to identify suitable test practices, approaches and techniques applicable to AI systems and their components. When the test practices, approaches and techniques are already specified in the ISO/IEC/IEEE 29119 series, this document provides additional detail and describes their application in the context of AI systems.

2 Normative references

3 Terms and definitions

4 Abbreviated terms

5 Introduction to AI systems and software testing

5.1 General

This clause provides a high-level introduction to AI systems and software testing.

The testing of AI systems and their components shall be performed in accordance with ISO/IEC/IEEE 29119-2.

Annex A provides an introduction to software testing.

5.2 AI system life cycle

Figure 1 shows an example of the AI systems life cycle from ISO/IEC 22989 and its relationship with software testing.

5.3 AI system functional view

Figure 2 depicts a functional view of a generic AI system from ISO/IEC 22989.

The “Model” depicted in the centre of Figure 2 is a machine-readable representation of knowledge. This knowledge can come from various sources, and different forms of AI system can be categorised depending on the source (or sources) of this knowledge.

Example AI systems include:

heuristic AI systems, such as a classical expert system or a reasoning system equipped with a fixed knowledge base;
ML-based AI systems, where the training dataset is processed to capture patterns, and build a ML model;
a continuous learning system, where incremental training of the AI model takes place on an ongoing basis;
a knowledge engineering system, where the knowledge base comprises interacting knowledge of contents and knowledge of methods.

Large AI systems can use several different technologies, each of which presents potential risks that can be treated through testing and reviews. Figure 3 depicts the AI ecosystem in terms of functional layers, as described in ISO/IEC 22989.

5.4 Risk-based testing

Risk-based testing (RBT) is a core concept in the ISO/IEC/IEEE 29119 series, which expects risks to be used as the prime driver for determining the test approaches included in the test strategy and therefore the consequent software testing.

Risk-based testing is similar to most other risk management processes. Initially potential risks are identified. Next, the identified risks are analysed to determine the potential consequence, and its severity, they can have on a delivered product or the project, if they occur. The likelihood of each risk is determined, which can be based on factors such as requirement quality, staff capabilities, system complexity and historical information. A risk exposure level is then established, based on combining the consequences and likelihood of each risk. Risks can then be prioritized accordingly, followed by deciding on the appropriate or possible treatments. A treatment for one risk can be the cause, or increased exposure, of another risk. Not all identified risks can be treated through RBT. For instance, a lack of trained program designers is not directly addressed by RBT. Risk treatments by testing can include the test approaches defined in ISO/IEC/IEEE 29119-1 and ISO/IEC/IEEE 29119-4, and the review techniques defined in ISO/IEC 20246.

Not meeting stakeholder requirements is a major risk for most projects, and as such, is a key consideration in the selection of test approaches. Contrary to common belief, this is not a choice between focusing on risk or focusing on requirements. Instead, both are vital considerations in a risk-based test strategy.

The test approach for treating a specific risk can take one or more forms, such as:

adopting an organizational test practice (e.g. continuous testing as a risk treatment for AI systems that can change behaviour in production);
deciding that a particular test level is used (e.g. model testing, if the performance of the AI model is perceived to be a risk);
selecting a test type, such as functional testing or data representativeness testing;
deciding on a form of static testing (i.e. reviews and static analysis);
selecting a test design technique (e.g. equivalence partitioning) and corresponding coverage measures (e.g. equivalence partition coverage).

Guidance on risk management for AI systems can be found in ISO/IEC 23894.

5.5 Test processes

5.6 Test documentation

Test documentation is produced as a result of performing the test processes and is defined in detail in ISO/IEC/IEEE 29119-3. The destination of the test documentation is either a stakeholder (e.g. test status reports to a project manager) or another process (e.g. a test plan to direct the performance of dynamic testing). As the test documentation comes from the processes, it can be categorized in terms of outputs at the three test process levels defined in ISO/IEC/IEEE 29119-2.

The documentation of the testing of AI systems and their components shall be produced in accordance with ISO/IEC/IEEE 29119-3.

See A.7 for more detail on test documentation.

5.7 Testing stakeholders

When using this document and the ISO/IEC/IEEE 29119 series in the context of AI systems, relevant stakeholders should be identified and documented. This defined group of stakeholders should be used consistently in all test processes.

6 Identifying risks in AI systems

7 Test approaches for testing AI systems

7.1 Introduction to test approaches for AI systems

7.2 Test levels

7.3 Test types

7.4 Test design techniques and measures

Bibliography