Does ISO/IEC 24029-3 apply to my AI system?

It applies if your system contains a neural network and you need to assess its robustness properties with statistical methods. The scope names neural networks, statistical methods and robustness properties. It binds no one by itself; a contract, regulation or management system has to adopt it.

What if the model is bought?

The public scope is silent on deployment model, so nothing in the text excludes a bought or embedded system. If a supplier's system contains a neural network, ask the supplier for the robustness evidence and the sampling basis.

What if I use formal methods only?

The FDIS is the statistical companion. A formal-only programme can still read it for the stability definition and the complementarity argument, but it is not using the document's method.

What should I do now?

Inventory the neural networks, write the stability claim for each, fix the sampling plan and the threshold, and put the result under a management system row. The free check turns that into three dated actions.