OECD Framework for Classifying AI Systems

· About OECD Framework for Classifying AI Systems

Key Takeaways

  • The OECD Framework for the Classification of AI Systems is a voluntary policy framework, not a binding regulation, so it does not itself impose legal compliance duties or penalties on companies.[1][2]
  • It applies broadly to AI systems deployed in specific contexts and is designed to help policymakers and organisations assess impacts across people, planet, economic context, data and input, AI model, and task and output.[1][2]
  • The framework was published in 2022 and continues to be referenced by OECD materials in 2025 and 2026 as a living policy tool, with no official amendment or delayed phase-in timetable identified in the source material reviewed.[1][3][10]
  • Because the framework is non-binding, there are no enforcement deadlines, maximum fines, or regulator-led sanctions attached to it; obligations arise only if a separate law, procurement rule, or internal governance policy adopts it.[1][2]
  • Organisations can still use it as a structured input to AI governance, risk assessment, and incident reporting, especially where they need a common taxonomy aligned with the OECD AI Principles.[1][3]

What It Is

The OECD Framework for the Classification of AI Systems is a policy-oriented classification tool developed by the OECD to help policymakers, regulators, legislators, and others characterise AI systems in specific real-world contexts.[1][2] It is linked to the OECD AI Principles and is intended to support nuanced policy and risk assessment rather than to serve as a mandatory legal standard.[1][11]

The framework classifies AI systems across five dimensions: People & Planet, Economic Context, Data & Input, AI Model, and Task & Output.[1][2] OECD publications in 2025 and 2026 continue to cite the framework as an established and “widely-used” reference for contextualising AI risk, without describing any replacement or formal amendment.[3][11]

The framework was published in 2022.[1][2] The source materials reviewed do not identify a formal “adopted” date in the treaty or regulatory sense, because the instrument is not a legal act, and they do not show a later force date, phase-in schedule, or postponement. OECD materials in 2025 and 2026 still describe it as current and in use.[1][3][10]

Who Must Comply

Strictly speaking, no one must comply with this framework as a standalone law, because it is not legally binding.[1][2] Any entity can use it voluntarily, including governments, regulated firms, product teams, and researchers.[1]

Its practical applicability is broad: it is meant for AI systems deployed in specific contexts, and OECD materials say it can be applied to the widest range of AI systems.[1][2] The framework is especially relevant for organisations seeking to map AI uses to policy implications, risk categories, or incident-reporting structures.[3][11]

There are no territorial thresholds, turnover thresholds, employee-count thresholds, or extraterritorial reach provisions in the framework itself.[1][2] There are also no enumerated exemptions, because the document is not a compliance statute; however, some dimensions are described as more relevant than others depending on whether the system is generic or deployed in a particular context.[2]

Core Requirements

  1. Contextual classification: Users should characterise the AI system in its real-world deployment context, not only by model type or technical architecture.[1][2]
  2. Five-dimensional assessment: Users should evaluate the system across People & Planet, Economic Context, Data & Input, AI Model, and Task & Output.[1][2]
  3. Policy relevance mapping: Users should identify the policy implications raised by the system’s attributes and use those findings to support trustworthy and innovative AI governance.[1]
  4. Risk assessment support: Users should use the framework as an input to risk assessment, including distinguishing lower-risk applications from those with higher potential impact.[3][11]
  5. Public-policy alignment: Users should connect the assessment to the OECD AI Principles, including issues such as transparency, robustness, accountability, fairness, and human-centred outcomes.[1][9]
  6. Documentation and comparability: Users should document the classification so that similar systems can be assessed consistently over time and across projects, which is one reason OECD describes the tool as “user-friendly.”[1][2]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Framework published | 2022 | OECD released the framework as a policy classification tool.[1][2] | | Current OECD references | 2025–2026 | OECD materials continue to cite and apply the framework in later work.[3][10][11] | | Enforcement date | N/A | No legal enforcement date exists because the framework is not a binding law.[1][2] |

There are no maximum fines and no standalone sanctions under the framework itself.[1][2] Any penalties would come only from a separate legal regime that independently adopts or references the framework.

How to Comply

  1. Inventory AI use cases. Create a register of all deployed and planned AI systems, including purpose, user group, geography, and decision impact.
  2. Map each system to the five OECD dimensions. Use the framework to classify People & Planet, Economic Context, Data & Input, AI Model, and Task & Output.
  3. Align the assessment with ISO 27001. Use ISO 27001-style controls for information security governance, supplier management, access control, logging, and incident handling where AI systems process sensitive data.
  4. Use NIST CSF 2.0 for operational risk management. Map the AI system into Identify, Protect, Detect, Respond, and Recover functions to structure governance and incident response.
  5. Adopt ISO 42001 for AI management systems. This maps well to policy setting, roles, controls, monitoring, and continuous improvement for AI governance.
  6. Define risk thresholds and escalation rules. Set internal criteria for when a system’s classification triggers human review, red-teaming, privacy review, or executive sign-off.
  7. Document decisions and evidence. Keep versioned records of the classification, inputs, assumptions, and approvals so the assessment can be audited or reused.
  8. Review after material change. Reassess when the model, training data, deployment setting, or user population changes materially.

Related Regulations

The EU AI Act is the closest substantive comparator: it is binding law with detailed obligations and penalties, while the OECD framework is a voluntary classification tool.[1][2] The NIST AI Risk Management Framework overlaps in risk-governance intent, but it is also non-binding and operationally focused rather than policy-classificatory. ISO/IEC 42001 overlaps on AI governance systems and documentation, but it is a certifiable management standard rather than a public-policy framework. The OECD AI Principles are the framework’s normative foundation, so the two should be read together rather than as competing instruments.[1][11] The EU GDPR can conflict in practice where AI classification prompts data mapping that reveals personal-data processing obligations not addressed by the OECD tool.

FAQ

Does the OECD Framework for Classifying AI Systems apply to companies outside the OECD?

Yes, in practical terms it can be used by any organisation anywhere because it is a voluntary OECD policy tool rather than a jurisdiction-specific law.[1][2] The framework itself does not impose territorial limits, and OECD publications describe it as applicable to a wide range of AI systems.[1]

Is the framework legally binding?

No. The framework is not a statute, regulation, or treaty, and it does not create direct legal duties, enforcement dates, or fines.[1][2] It is best understood as a shared policy taxonomy for classifying AI systems and informing governance.

Does the framework require certification or registration?

No certification or registration requirement appears in the framework itself.[1][2] Organisations may still choose to embed it in internal review processes, procurement gates, or AI governance committees.

What changed in 2025 or 2026?

The sources reviewed do not show a formal amendment, reissue, or delayed phase-in in 2025 or 2026.[1][3][10] What is visible is continued OECD usage and citation of the framework in later reports and events, which suggests ongoing relevance rather than a new legal cycle.[3][11]

Can the framework be used for AI incident reporting?

Yes. OECD materials in 2025 describe the framework as useful for distinguishing AI applications by their potential impact, and the framework has been referenced as a basis for more detailed AI risk assessment and incident-reporting work.[3] That said, incident-reporting duties themselves come from separate laws or organisational policies, not from the framework alone.

Should organisations treat the framework as a substitute for ISO 42001 or NIST CSF 2.0?

No. It is complementary, not substitutive.[1][2] Use the OECD framework to classify and contextualise AI systems, then use ISO 42001 and NIST CSF 2.0 to operationalise governance, controls, and risk management.

Sources

Put it into practice

More compliance guides