For Heads-of · Practitioner
AI system lifecycle controls gap
AI systems lack defined lifecycle controls, so changes ship without a consistent governance checkpoint from requirements through decommissioning.
- medium
- governance
- lifecycle
- change-control
How it happens
A model or prompt gets updated, retrained, or replaced through the normal software deployment pipeline, with no AI-specific gate checking that the change was validated, documented, and approved the way the original system was.
Why it matters
Governance that only applies at initial launch decays quickly: most of an AI system's risk exposure over its life comes from changes made after the day-one review, not from the day-one state itself.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| ISO/IEC 42001:2023 | Annex A.6 | AI system life cycle |
Related resources
The external sources behind this risk, from the Resources library.