AI system lifecycle
The staged flow an AI system moves through from planning to decommissioning, each stage carrying its own controls under ISO 42001.
The AI system lifecycle is the end-to-end path from inception to retirement for a production AI system. ISO/IEC 42001 anchors several Annex A controls (A.6 lifecycle, A.7 data) to specific stages so the responsible-AI programme stays current as the system evolves. The stages typically recognised are: planning and requirements, data acquisition and preparation, model design and development, verification and validation, deployment, operation and monitoring, and decommissioning. Controls differ by stage — evaluation reports belong to verification; drift monitoring and incident response belong to operation; data retention and model deletion belong to decommissioning.
Examples
- →Verification stage: a documented evaluation report covering accuracy, robustness and bias metrics must pass before promotion to production.
- →Operation stage: drift monitors, output logging, feedback channel and an incident-response playbook are in place and reviewed monthly.
- →Decommissioning stage: model weights archived or destroyed, inference logs retained per policy, affected downstream systems notified.
Common mistakes
- ✗Collapsing verification and deployment into a single stage. Auditors expect verification evidence that is dated before the deployment date.
- ✗Skipping decommissioning. Shadow retired models that are still callable from a legacy endpoint are a common audit finding.
How LowerPlane handles it
LowerPlane's AI-system inventory tracks each model's lifecycle stage and the evidence required at the next transition (eval report before deployment, drift config before operation, deletion attestation before decommissioning).
Authoritative sources
Related reading on LowerPlane
Related terms
- ISO/IEC 42001 — International standard for an Artificial Intelligence Management System (AIMS).
- ISO 42001 Annex A — The 38 AI-specific controls that make ISO 42001 auditable — the AI analogue of ISO 27001 Annex A.
- AI Impact Assessment (AIIA) — A structured review of an AI system's potential harms, benefits and affected parties — required by ISO 42001 Annex A.
- AIMS (AI Management System) — The policy, process and control stack that ISO 42001 certifies — the AI-governance analogue of an ISMS.