Risk management and AI system life cycle

Annex C (informative) shows, as an example, how the clause 6 process lines up with the stages of an AI system life cycle as ISO/IEC 22989 describes them: at which stages each clause 6 activity takes place (communication and consultation, setting scope and context, assessment, treatment, review and monitoring, and reporting and recording), so an organization can build the process into the way it develops and operates AI systems. Read risk management and ai system life cycle at the life cycle point the system has actually reached.

What it asks

Annex C (informative) shows, as an example, how the clause 6 process lines up with the stages of an AI system life cycle as ISO/IEC 22989 describes them: at which stages each clause 6 activity takes place (communication and consultation, setting scope and context, assessment, treatment, review and monitoring, and reporting and recording), so an organization can build the process into the way it develops and operates AI systems.

Where generative AI changes the answer

The life cycle view is what stops the assessment ending at deployment, because most generative AI risk appears in operation and use.

Reading it in practice

The life cycle view keeps the assessment running past deployment. For generative AI the operation and use stages carry most of the risk, because the corpus, the users and the vendor all change after go-live. The evidence is a gate record that shows what was re-assessed at each stage and who signed the decision to continue.

Who it binds

The AI system owner across the life cycle, with the risk owner at each gate. For C the named role is the owner of the organization's own mapping of risk activities to its AI life cycle stages.

Evidence an auditor normally samples

• The organization's own mapping of risk activities to its AI life cycle stages

The test you can run

Ask for the organization's own mapping of risk activities to its AI life cycle stages and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• Risk management run as a separate cycle from system development

Before the draft publishes

For C, place the use on the life cycle, mark where it actually is, and record which risk steps have and have not been done at that point. The first artefact to produce is the organization's own mapping of risk activities to its AI life cycle stages.

Where this sits against the draft

C carries the annex c: the ai system life cycle part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on C (risk management and ai system life cycle) with this record and note the change in the register.