Published 16 October 2026, IEEE 2863 is a voluntary recommended practice that gives boards and governance bodies a structured way to govern AI development and use across an organization. It is principles, implementation processes and case studies — not a certification scheme, and not a substitute for the technical controls engineering teams already own.
IEEE Recommended Practice for Organizational Governance of Artificial Intelligence — board approved 4 June 2026, published 16 October 2026.
Governance principles for the governance body to prioritize, the processes to implement them, and case studies — aimed at leadership, not engineering teams directly.
A recommended practice, not certifiable like ISO/IEC 42001 — it complements a management-system approach rather than replacing one.
IEEE 2863, “IEEE Recommended Practice for Organizational Governance of Artificial Intelligence,” is an IEEE Standards Association document whose project authorization was approved back in February 2020, with the IEEE SA Standards Board giving final approval on 4 June 2026 and the standard publishing on 16 October 2026. It carries “Active Standard” status. The multi-year development arc is typical for a standard that has to stay relevant as AI practice itself moved quickly underneath it.
As a “recommended practice” rather than a management-system standard or a regulation, IEEE 2863 is voluntary and not certifiable — there is no accredited body that audits an organization against it and issues a certificate. Its value is as a structured reference that a governance body can adopt, adapt and be measured against internally, or cite as evidence of a considered governance approach.
IEEE 2863 is deliberately pitched above the engineering layer. It is not about model testing, red-team findings on a specific system, or the technical controls an AI engineering team already owns — those are covered by other standards and by an organization's own technical practice. It is about the governance body: who at the top of the organization is accountable for AI decisions, how AI risk gets surfaced to that level, what principles the governance body should weigh when authorizing AI use, and how those principles turn into repeatable processes rather than one-off decisions.
The standard sets out governance principles for a governance body to consider and prioritize, along with processes for implementing them, and case studies illustrating how the principles play out in practice. Its subject areas, per IEEE's own documentation, span accountability, auditing, competency of the people involved in AI governance, human oversight, incident response, red teaming as a governance input rather than only a technical exercise, stakeholder engagement, and value-chain management — recognizing that most organizations do not build every AI component themselves and have to govern what they source as carefully as what they build.
The three sit at three different layers, and an organization typically needs more than one. The EU AI Act is binding law for organizations it covers — it is not optional. ISO/IEC 42001 is a voluntary, certifiable management-system standard that an organization can use to demonstrate day-to-day AI governance discipline to customers, partners and regulators. IEEE 2863 is a voluntary recommended practice aimed at the governance body itself — the board or leadership group deciding what the organization's AI risk appetite and accountability structure should be in the first place. Many organizations use IEEE 2863 to shape that governance-body-level design before or alongside pursuing 42001 certification, so the management system they build is answering to a governance structure that has already thought through its priorities.
IEEE 2863 published the same month as ISO/IEC 27090:2026 (AI-specific security threats) and EN 18286:2026 (the EU AI Act's first harmonized standard, covering quality management). Taken together, the three address three distinct dimensions of the same problem: ISO/IEC 27090 catalogues the AI-specific security threats a system faces, EN 18286 gives EU AI Act-covered providers a route to regulatory quality-management conformity, and IEEE 2863 governs the organizational decisions sitting above both. None of the three substitutes for the others — an organization serious about AI governance in late 2026 has reason to look at all three rather than treating any one as sufficient on its own.
No. IEEE 2863 is a recommended practice, not a certifiable management-system standard — there is no accredited certification scheme against it. Organizations adopt it as internal governance guidance or cite it as evidence of a considered governance approach, rather than displaying a certificate earned against it.
Boards and governance bodies responsible for AI oversight at the organizational level, not engineering or technical teams directly. It sits above the day-to-day management-system layer that standards like ISO/IEC 42001 cover, focusing on accountability, risk appetite and governance-body decision-making.
The three address distinct, complementary dimensions rather than overlapping. ISO/IEC 27090 catalogues AI-specific security threats and mitigations. EN 18286:2026 gives EU AI Act-covered providers a route to quality-management conformity. IEEE 2863 governs the organizational decisions and accountability structures above both. An organization serious about AI governance typically needs to draw on more than one.