AI vocabulary and the law by market

Where the vocabulary meets the law

ISO/IEC 22989 is a voluntary terminology standard. It creates no legal duty on its own. The duties come from the law and regulation of each market, and those instruments borrow AI vocabulary in their own way. This page names the instruments that matter to the buyer in four markets and says plainly which texts we quote and which we only name.

How to read this page. A named instrument is not a quoted instrument. We do not hold the text of the laws below, so we name the obligation and the source, and we do not state a clause or a penalty as if we had read it. Check the current official text before you rely on it.

United States

The federal position is guidance rather than a single AI statute. The NIST AI Risk Management Framework is the reference most US AI governance programmes use, and it shares the vocabulary of trustworthiness, risk and life cycle with ISO/IEC 22989. Sector regulators and state privacy laws add duties on data, notice and automated decisions. The vocabulary work is voluntary; the privacy duties are not.

European Union

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, is the primary instrument. It defines AI system and sets obligations by risk category, with duties for providers and deployers. A firm that uses the ISO vocabulary in its AI Act evidence should map the two, because the regulation has its own definitions and its own scope tests. The ISO standard does not replace the regulation.

United Kingdom

The UK has no single AI act. The approach is a pro-innovation framework applied by existing regulators, with the Information Commissioner's Office leading on data protection and AI guidance. A UK firm can use ISO/IEC 22989 as a shared vocabulary, but its legal duties come from data protection law and the sector regulator, not from the standard.

Australia

The Australian government publishes voluntary AI ethics principles and guidance for organisations, and the Privacy Act 1988 sets the binding duties on personal information. The standard is useful as a vocabulary; it is not an Australian legal instrument and does not create a duty.

What this means for the register

Keep two columns in the kit: the standard entry and the legal instrument that uses the same idea. They are not the same claim. The standard tells you what a word means; the law tells you what you must do. A register that blurs them will fail the first legal review.

Last updated: 2026-10-21