System life cycle issues

AI-related risk source: Risk can arise at every stage of an AI system's life, from inception and design through development, verification, deployment, operation, monitoring and retirement, and from transitions between stages, including changes and updates. The artefact behind the answer is life cycle plan with risk activities at each stage. Use system life cycle issues as a prompt in the identification step, not as a finding.

What it asks

AI-related risk source: Risk can arise at every stage of an AI system's life, from inception and design through development, verification, deployment, operation, monitoring and retirement, and from transitions between stages, including changes and updates.

Where generative AI changes the answer

Life cycle issues are acute for generative AI because the model, the prompts and the corpus each change on their own schedule.

Reading it in practice

Life cycle issues are acute because the model, the prompts and the corpus each change on their own schedule, often under a supplier's control. The evidence is a change log that ties each version to the assessment and the test that followed it. Without that link, the organisation cannot say what its last assessment actually covered.

Who it binds

The assessment team that runs identification, and the business owner who knows the use. For B.7 the named role is the owner of life cycle plan with risk activities at each stage.

Evidence an auditor normally samples

• Life cycle plan with risk activities at each stage

The test you can run

Take life cycle plan with risk activities at each stage and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Risk considered at design and never at retirement or update

Before the draft publishes

For B.7, add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present. The first artefact to produce is life cycle plan with risk activities at each stage.

Where this sits against the draft

B.7 carries the annex b: ai-related risk sources part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on B.7 (system life cycle issues) with this record and note the change in the register.