Daniel's latest prompt is a love letter to the organization that decided how to spell countries and brew tea in the same breath. He got enthusiastic about ISO standards after a previous job where financial data arrived with countries spelled however the person felt that morning. Ireland, Republic of Ireland, Eire, sometimes just a shamrock emoji. And the fix for that chaos was a set of tables so mundane that nobody thinks about them until a database join fails at three in the morning. He wants to look at the breadth of what ISO has actually promulgated, the unsung hero standards for country and currency codes, the remarkably long tail of niche standards that never really took off, the history of the organization itself, and the fact that the actual texts are locked behind a paywall that makes them prohibitively expensive for normal people. So today we're going to open the ISO catalogue and see what's actually in it.
The number that always stops me is twenty-five thousand. Over twenty-five thousand published standards, and that's not counting the ones in development or withdrawn. You could read one a day and you'd be at it for nearly seventy years. And the range is genuinely absurd. There's a standard for the little green running man on emergency exit signs. There's a standard for how to brew tea for a taste test. There's a standard for the screw threads that hold your chair together and one for managing artificial intelligence systems. All from the same organization, all using the same consensus process.
So what exactly is this organization that decides how we spell countries and brew tea?
The International Organization for Standardization. Founded in nineteen forty-seven, headquartered in Geneva. It's not a government body, which surprises people. It's a non-governmental network of national standards bodies, one per country. So the American National Standards Institute represents the US, the British Standards Institution represents the UK, and so on. A hundred and seventy or so member countries. The actual work happens in technical committees, thousands of them, where experts from industry, government, and academia volunteer their time to draft standards. Then the member bodies vote. Consensus is the whole mechanism.
And the name. The name is the first thing people get wrong. ISO. Everyone assumes it's an acronym for International Organization for Standardization. It isn't. It's derived from the Greek word isos, meaning equal. They chose it deliberately so the abbreviation would be the same in every language. If they'd used the English initials it would be IOS. In French, the official languages being English and French, it would have been OIN for Organisation Internationale de Normalisation. So they picked a word that means equal, which is also the entire point of standardization. Equal measures, equal parts, equal understanding.
The history goes back further than forty-seven, though. There was a predecessor organization called the International Federation of the National Standardizing Associations, the ISA, which operated from nineteen twenty-six until nineteen forty-two. It collapsed during the war. The original impetus was purely industrial. Screw threads, bolts, interchangeable parts. If you're manufacturing a machine in one country and repairing it in another, the bolt has to fit the hole. That was the founding problem. In fact, the very first ISO recommendation, published in nineteen fifty-one, was about standard reference temperature for industrial length measurements. Twenty degrees Celsius. Before that, a meter of steel in a cold room and a meter of steel in a hot room were literally different lengths.
Twenty degrees. The temperature of a pleasant day in Geneva, presumably.
Probably not a coincidence. But the screw thread thing is the ur-example. Before standardization, every manufacturer had their own thread pitch. A bolt from one factory wouldn't fit a nut from another. It was a genuine barrier to trade and repair. The effort to fix that started in the nineteenth century, really, with national standards, and then international coordination followed. It's the same problem Daniel had with country names, just in steel instead of spreadsheets. Everyone had their own system, and the systems didn't talk to each other.
Let's start with the standards that touch everyone, every day, without them knowing it.
ISO thirty-one sixty-six and ISO forty-two seventeen. Country codes and currency codes. These are Daniel's unsung heroes, and they deserve the title. ISO thirty-one sixty-six gives every country and territory a three-part identifier. A two-letter alpha code, a three-letter alpha code, and a three-digit numeric code. So the United States is US, USA, and eight forty. Ireland is IE, IRL, and three seventy-two. All three are valid, all three are standardized, and which one you use depends on context. The two-letter codes are what you see in domain names and shipping labels. The three-letter codes are used in passports and sports broadcasts. The numeric codes are used when you need language independence, because the number three seventy-two doesn't change whether you're reading it in English, Arabic, or Mandarin.
And the point is that the table exists at all. Before it, you had exactly Daniel's problem. Every database had its own country column. Someone wrote Eire, someone wrote Republic of Ireland, someone wrote Ireland, someone wrote IRL because they'd seen it on a license plate. And the moment you try to join two databases, nothing matches. The standard table is the translation layer that makes the join trivial. You map everything to the same code and suddenly the data is comparable.
The currency standard is even more interesting because it encodes more than just a name. ISO forty-two seventeen gives every currency a three-letter code, a numeric code, and something called the minor unit exponent. The three-letter code is what you know. USD, EUR, JPY, GBP. The first two letters are usually the country code from thirty-one sixty-six, and the third is the currency name. The numeric code is used in financial messaging systems. But the minor unit exponent is the part that breaks things if you ignore it.
Explain the exponent.
It tells you how many decimal places the currency uses. Most currencies have a minor unit of two, meaning one hundred subunits per main unit. One US dollar is one hundred cents. One euro is one hundred cents. The exponent is two. But the Japanese yen has a minor unit exponent of zero. There are no decimal places. One yen is the smallest unit. If you're building a currency conversion system and you assume every currency has two decimal places, you'll format yen incorrectly. You'll show one hundred point zero zero yen, which is wrong, or worse, you'll do arithmetic that treats a yen as if it had cents. The standard encodes the exception so the system doesn't have to guess.
And there are edge cases. Some currencies have three decimal places. The Bahraini dinar, I think, divides into a thousand fils. And there are currencies with exponent one, where one unit divides into ten. The standard handles all of them because the table was built by people who actually had to move money across borders.
The Kuwaiti dinar has an exponent of three. The Mauritanian ouguiya and the Malagasy ariary have exponent one in their current definitions. But the point isn't the trivia. The point is that every financial transaction, every e-commerce checkout, every international wire transfer, every shipping label, every mobile payment that crosses a border is silently consulting these tables. When you tap your phone to pay in a foreign country, the terminal is using ISO forty-two seventeen to identify the currency and ISO thirty-one sixty-six to identify the country. It's the substrate of global commerce, and nobody sees it.
And the scale of the catalogue is what Daniel's really asking about. Twenty-five thousand standards. Let's talk about the famous ones before we get to the weird stuff.
ISO nine thousand one is the best-known, the quality management standard. It's a certification that companies pay for. Millions of organizations worldwide are certified. The idea is that you document your processes, you monitor them, you improve them, and an external auditor verifies that you actually do what you say you do. It's controversial, honestly. Some people say it's a genuine framework for operational excellence. Others say it's a paperwork exercise that produces a certificate for the wall and not much else. The truth is probably that it depends entirely on whether the organization takes it seriously.
I've said before that a certificate on a wall is not governance, it's decoration. The value of any management standard is whether the documented system is actually used. If the quality manual lives in a binder that nobody opens except the week before the audit, the standard didn't do anything.
And that's the real question for the AI standards, which are the new frontier. ISO IEC forty-two thousand one, published in twenty twenty-three, is the first AI management system standard. It's structured like nine thousand one but for AI. It asks organizations to think about risk, about accountability, about how they monitor AI systems in production. There's more work in progress on AI governance and compliance. The question is whether these standards will actually shape behavior or just produce another certificate industry.
But that's a question for later. Let's talk about the breadth first. Twenty-five thousand standards. What's the range?
Everything. Screw threads, which was the original problem. Container shipping, which is one of the great standardization success stories. The shipping container is standardized by ISO six sixty-eight, and that standard is the reason a container loaded in Shanghai can be lifted by a crane in Rotterdam without anyone checking whether it fits. Before standardization, there were dozens of container sizes, and ports had to handle all of them. The standard made global trade dramatically cheaper. There's a standard for film speed, ISO fifty-eight hundred, which is why your camera knows what ISO four hundred means. There's a standard for the format of PDF files, ISO thirty-two thousand. There's a standard for the safety symbols on machinery. There's a standard for the dimensions of credit cards, ISO IEC seventy-eight ten, which is why every card in your wallet is the same size and the chip is in the same place.
The credit card one is quietly enormous. Every card reader on Earth assumes the card is exactly eighty-five point six millimeters by fifty-three point nine eight millimeters. If a bank issued a card that was a millimeter wider, every terminal would reject it. The standard is what makes the card reader a commodity instead of a custom device.
And the standards stack. A single credit card transaction touches dozens of standards. The card dimensions, the magnetic stripe encoding, the chip protocol, the currency code, the country code, the merchant category code, the security standards. All of them from ISO or from related bodies like EMVCo. The transaction clears in seconds because every party agreed on the same tables ahead of time.
But the catalogue doesn't stop at currency codes. That's where it gets strange.
The long tail is the fun part. Thousands of standards that are technically sound, precisely specified, and almost completely unused. The famous example is ISO thirty-one oh three, the standard method for brewing tea for sensory testing. It's real. It specifies a two-gram sample of tea, water at one hundred degrees Celsius, a six-minute steep, and a specific porcelain vessel. The vessel has to be white porcelain or glazed earthenware, with a lid, and the tea is poured through the lid to strain it. The standard exists so that tea tasters in different laboratories can compare results. If you brew tea differently, you're tasting the brewing method, not the tea.
The porcelain vessel is the detail that gets me. They didn't just specify the temperature and the time. They specified the material and the color of the pot. That's the level of precision the long tail operates at. Someone, somewhere, spent committee time debating whether the pot should be white.
And that's the thing about the consensus model. Any industry group can propose a standard if they can gather enough expert support. The tea industry had a real problem. They needed sensory testing to be reproducible across labs. So they convened experts, they ran experiments, they argued about pot color, and they produced a standard. Whether anyone outside the tea industry uses it is irrelevant to the process. The standard exists because a group of people needed it.
The adoption problem is where it gets interesting. A standard is only valuable if people use it. ISO nine thousand one has millions of certified organizations. ISO thirty-one oh three is a curiosity that podcast hosts mention as the pinnacle of niche. The long tail is full of standards that were technically sound but commercially stillborn. The market chose otherwise, or never noticed.
The paper size standard is the great example of a standard that won everywhere except one place. ISO two sixteen defines the A series. A four, A three, A two, and so on. The defining property is that each size is half the previous one, and the aspect ratio is the square root of two. That ratio means you can scale a document from A four to A three and it keeps the same proportions. It's mathematically elegant. Nearly every country on Earth uses it. The United States and Canada use Letter size, which is eight and a half by eleven inches, a ratio that's close to but not exactly the same. It's a live example of a standard that failed to achieve universal adoption, and the reason is path dependence. The US was already committed to Letter size before the A series existed, and switching would have meant replacing every printer, every filing cabinet, every envelope.
And the date format standard is the inverse. ISO eighty-six oh one defines the date format as year-month-day. Two thousand twenty-six dash zero eight dash fourteen. It sorts correctly as text. It's unambiguous. It's universally used in computing. Every programmer loves it. And most people still write dates the old way in everyday life. August fourteenth, twenty twenty-six, or fourteen August, depending on where you live. The standard won the technical world and lost the human world.
The American date format is the one that causes actual problems. Month-day-year. Is zero eight zero seven twenty-six August seventh or July eighth? Depends on which side of the Atlantic you're on. ISO eighty-six oh one was designed to eliminate that ambiguity, and it did, in databases and log files and API responses. But you can't standardize human habit by committee.
The cost barrier is the part of Daniel's prompt that deserves real attention. ISO standards are not free. A single standard can cost a hundred to two hundred Swiss francs. The full catalogue is twenty-five thousand standards. Do the math. It's a fortune. The standards are meant to be shared infrastructure, the rules of the modern world, and they're sold as intellectual property.
This is a genuine tension. ISO is a non-governmental organization, but it's funded by selling standards. The national bodies also sell them. The argument is that developing standards costs money. The experts volunteer their time, but the administration, the publication, the maintenance, the translation, all of that has to be paid for. The counterargument is that standards are infrastructure. They're like roads or the DNS system. The people who most need to read them, small businesses, students, developers in poor countries, often can't afford to.
Daniel's point about the texts being out there is the quiet part said out loud. Shadow libraries, leaked PDFs, copies floating around on file sharing sites. The standards are widely pirated. And it's hard to argue the pirates are wrong when the legitimate price is a hundred and fifty Swiss francs for a document that's twenty pages long and was written by volunteers.
The pricing creates a weird dynamic. The people who use the standards professionally, the big companies, they pay for them. It's a rounding error in their budget. The people who are curious, the students, the hobbyists, the small operators, they can't justify the cost. So they find other ways. Or they don't read the standard at all, and they rely on secondary sources, blog posts, Wikipedia summaries, which are often wrong in subtle ways. The paywall actively degrades the quality of public understanding.
And the standards that matter most for safety are sometimes the most expensive. If you're building a machine and you need to know the safety requirements, the standard that tells you is locked behind a paywall. The alternative is to guess, which is how accidents happen.
Some standards bodies have moved toward free access. The W three C standards are free. The IETF standards are free. They're funded differently. ISO has resisted that model, partly because the national bodies depend on the revenue. It's a structural problem, not a simple greed problem. But the effect is the same. The rules of the modern world are written behind a paywall.
Let's talk about the history a bit more, because Daniel asked about it specifically. The organization started in nineteen forty-seven, but the impulse is older. The screw thread problem was being discussed at international conferences in the late nineteenth century. The First World War made it urgent. The Second World War made it existential. After the war, there was a deliberate effort to build international institutions that would prevent the kind of economic fragmentation that had helped cause the war. The United Nations, the World Bank, the IMF, and ISO. Same era, same impulse. Coordination instead of chaos.
And the early work was all industrial. Screw threads, bolts, tolerances, measurement. The idea was that if you standardize the physical world, you make trade easier, and if trade is easier, countries are less likely to go to war. It's a very mid-century idea, and it mostly worked. The later expansion into management standards, quality, environmental, information security, that came in the nineteen eighties and nineties. ISO nine thousand one was first published in nineteen eighty-seven. That was the moment ISO stopped being just about physical things and started being about processes and systems.
The information security standard, ISO twenty-seven thousand one, is another one of the big ones. Published in two thousand five. It's a management system for information security. Companies get certified, auditors come in, and the certificate is supposed to demonstrate that the company takes security seriously. Same dynamic as nine thousand one. The certificate is only as good as the implementation.
And now the AI standards. ISO IEC forty-two thousand one, published in twenty twenty-three, is the first AI management system standard. It's built on the same template as nine thousand one and twenty-seven thousand one. Plan, do, check, act. Document your AI systems, assess the risks, monitor the outputs, have accountability. There's more work in progress. ISO IEC forty-two thousand five is a code of practice for AI, published in twenty twenty-four. There's work on AI risk management, AI governance, AI auditing. The question is whether any of it will actually shape behavior.
My prior on this is that a management standard is only as good as the organization's commitment to actually using it. If a company gets ISO forty-two thousand one certified and then ships a model that hallucinates in production and nobody notices, the certificate didn't do anything. The standard is a framework, not a guarantee.
The counterargument is that the framework itself creates the conditions for noticing. If you have to document your AI systems, if you have to name a responsible person, if you have to define what acceptable performance looks like, you're more likely to catch the hallucination than if you never thought about it. The standard doesn't guarantee good outcomes. It guarantees that someone asked the questions.
That's the charitable version. The uncharitable version is that the certification industry will sell certificates to anyone who can afford the auditor, and the standard will become a compliance checkbox. The EU AI Act references harmonized standards, which means the standards could become legally significant in Europe. That raises the stakes. If the standard is the path to compliance, everyone will buy it, and the question of whether it actually works becomes secondary.
The adoption question is open. Will ISO forty-two thousand one follow the path of nine thousand one, millions of certifications, a whole industry of auditors and consultants? Or will it follow the path of thirty-one oh three, a curiosity that nobody outside a small circle ever uses? The answer probably depends on regulation. If the EU and other jurisdictions require certification or recognize it as evidence of compliance, it'll be huge. If not, it'll be a niche standard for companies that want to signal responsibility without any legal requirement.
The tea standard is the perfect emblem of the long tail. It's real, it's precise, it specifies the color of the pot, and almost nobody has ever used it. But it's also a reminder that the people who wrote it had a real problem. They needed to compare tea across laboratories, and the only way to do that is to control every variable. The standard is absurd from the outside and perfectly rational from the inside.
That's the thing about the long tail. Every one of those niche standards was someone's real problem. The tea industry needed reproducibility. The people who wrote the standard for the little green running man on emergency exits needed a symbol that would be recognized across languages and cultures. The standard for the dimensions of a shipping container was a compromise between competing national systems, and it took years to negotiate. None of it is arbitrary. It's all the residue of real coordination problems.
The zombie standards are the saddest category. Standards that were written, published, and then never adopted by anyone. They exist on paper. They're in the catalogue. You can buy them for a hundred and fifty Swiss francs. But no one uses them, and no one ever will. The market chose otherwise, or the problem they solved disappeared, or the standard was overtaken by a competing standard from a different body.
And sometimes the adoption failure is because the standard was too early or too late. The OSI networking model is the classic example from a different standards body. ISO did publish the OSI reference model, and it lost to TCP IP in practice. The standard was elegant and complete and arrived just in time to be ignored by the market. The long tail is full of OSI models. Elegant solutions to problems that the market solved differently.
The paywall makes the long tail even more inaccessible. If you're curious about the tea standard, you can read about it on Wikipedia. But if you want to read the actual text, the precise wording, the exact temperature tolerance, you have to pay. And most people won't. So the long tail is doubly obscure. Niche and expensive.
The shadow libraries are the market's answer. If the standard is too expensive, people will share it. It's the same dynamic as academic papers. The people who write them don't get paid, the people who review them don't get paid, and the publisher charges thirty dollars for access. The system is optimized for the publisher, not the user. ISO is the same shape. The experts volunteer, the committees are open to anyone who can get their national body to nominate them, and then the output is sold back to the public.
The defense is that the national bodies do real work. They run the committees, they provide the infrastructure, they translate the standards. That costs money. The question is whether selling the standards is the right way to fund it, or whether it's just the path of least resistance.
Hilbert: I did barcode scanners for a warehouse logistics company in the late nineties. Small outfit. The boss wouldn't pay for the spec. ISO IEC fifteen four twenty, the EAN UPC barcode symbology standard. A hundred and fifty Swiss francs, which was about ninety dollars then. He said standards were for the big guys. So I reverse-engineered it from a competitor's scanner and a library book.
Hilbert: The thing about barcodes is everyone thinks they're just lines. They're not. They're a precise encoding scheme. Guard patterns at the start and end, check digits in the middle, quiet zones on both sides so the scanner knows where the code begins. Get the module width wrong by one unit and the scanner reads garbage. I spent three weeks getting it right, and the whole time I was thinking, the spec is ninety dollars and it would have saved me a month.
Hilbert: The check digit algorithm is the part that stuck with me. Modulo ten. Same algorithm as ISBN numbers and credit cards. It's a way of catching transcription errors. If someone types a digit wrong, the check digit doesn't match and you know the code is bad. I once spent a weekend calculating check digits by hand to debug a batch of misprinted labels. Turned out the printer was swapping two digits in the company's internal product codes. The internal codes weren't standardized, because the boss thought standards were for the big guys. So the barcode was fine, the check digit was fine, and the product codes underneath were wrong.
Hilbert: My brother-in-law works in shipping now. He says the same thing. The standards that matter are the ones nobody sees. The container dimensions, the barcode symbology, the currency codes. The stuff that just works. He says the niche standards are a different animal. Some of them are real, some of them are someone's pet project that got enough votes. He's not to be trusted, but he's been in the business thirty years.
The check digit detail is a good example of the standard working exactly as designed. The barcode standard caught the error. The problem was upstream, in the internal system that wasn't standardized. The standard can't save you from your own data.
The printer swapping digits is exactly Daniel's country name problem in miniature. The standard table exists, but if your internal data doesn't use it, the standard can't help. The failure mode is always the interface between the standardized layer and the unstandardized layer.
Hilbert: The boss eventually paid for the spec, after the misprinted labels cost him a customer. Ninety dollars then, and it would have saved him the customer and my weekend. That's the thing about the paywall. It's not just the money. It's the delay. The month I spent reverse-engineering the barcode standard was a month the company was shipping late.
That's the cost argument in a nutshell. The standard costs ninety dollars, and the absence of the standard costs a month of engineering time, a lost customer, a weekend of manual debugging. The paywall is a false economy for everyone except the standards body.
The question is whether the standards body sees it that way. They get the ninety dollars either way. The downstream costs are someone else's problem.
Hilbert: The library book was from nineteen eighty-nine. It had the guard patterns and the module widths, but it didn't have the quiet zone spec. So I got the quiet zone wrong for the first batch. The scanner read the code, but only if you held it at exactly the right angle. The spec would have told me. The library book was close but not close enough.
That's the danger of the shadow libraries and the secondary sources. They're often close but not exact. The quiet zone is the kind of detail that gets lost in a summary. The actual standard specifies it precisely, and if you don't have the actual standard, you're guessing.
Where does this leave us?
The open question is the AI standards. ISO IEC forty-two thousand one and its successors are being written right now, in committees, by volunteers, behind the same paywall as everything else. The question is whether they'll follow the path of nine thousand one, millions of certifications and a whole industry, or the path of thirty-one oh three, a curiosity that nobody outside a small circle ever uses. The answer probably depends on regulation, and the regulation is still being written.
The deeper tension is the paywall itself. Standards are the invisible infrastructure of civilization. They're why your credit card works abroad, why your barcode scans, why your spreadsheet can join with another company's. And the rules of that infrastructure are written behind a paywall. The people who most need to read them often can't afford to. What does it mean that the modern world runs on documents that are supposed to be shared infrastructure but are priced like luxury goods?
If you take one thing from this episode, it's that the mundane standards are the ones doing the most work. The country codes and currency codes that Daniel's old job needed are the substrate of every financial transaction on Earth. The long tail is fun to talk about, the tea standard is a great story, but the quiet miracle is the table that says Ireland is IE, IRL, and three seventy-two, and that everyone agrees on it.
The agreement is the whole thing. The standard is just a table. The miracle is that a hundred and seventy countries all decided to use the same one.
Thanks to Hilbert Flumingtop for producing, and for the barcode war story. This has been My Weird Prompts. If you've ever wondered what else is in the ISO catalogue, or wanted to see the tea-brewing standard for yourself, check the show notes at my weird prompts dot com. We'll be back soon.
