# B.7 System life cycle issues

AI-related risk source: Risk can arise at every stage of an AI system's life, from inception and design through development, verification, deployment, operation, monitoring and retirement, and from transitions between stages, including changes and updates. The artefact behind the answer is life cycle plan with risk activities at each stage. Use system life cycle issues as a prompt in the identification step, not as a finding.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause B.7
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

AI-related risk source: Risk can arise at every stage of an AI system's life, from inception and design through development, verification, deployment, operation, monitoring and retirement, and from transitions between stages, including changes and updates.

## Where generative AI changes the answer

Life cycle issues are acute for generative AI because the model, the prompts and the corpus each change on their own schedule.

## Who it binds

The assessment team that runs identification, and the business owner who knows the use.

## Evidence an auditor samples

- Life cycle plan with risk activities at each stage

## The test you can run

Ask the assessment team to name the risk sources they considered. Compare the list with the ones present in the use.

## Common failures

- Risk considered at design and never at retirement or update

## Before the draft publishes

Add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.