The AI Lifecycle Is Longer Than You Think

Most people picture AI governance as a gate at launch: check the system, approve it, done. ISO 42001 sees a much longer story.

An AI system has a lifecycle. It is designed. It is trained on data. It is tested, deployed, monitored, updated, and eventually retired. Risks live at every stage, not just the glamorous ones.

Consider the quiet stages. Data collection: was the training data gathered fairly and legally? Updates: did last month's model retraining change behavior in ways nobody noticed? Retirement: when you switch the system off, where does its data go, and who is told?

This is why the standard insists on lifecycle thinking. A risk assessment done once at launch is a photograph. Governance needs the whole film.

In practice, this means two habits. First, revisit your risk thinking at every major lifecycle event — new data, new version, new use case. Second, plan the ending at the beginning: know how you will monitor, update, and eventually retire each system before you deploy it.

AI systems are not appliances you install and forget. They are more like gardens. Plant carefully, tend regularly, and know when to pull something out.

I explain frameworks; I don't give legal counsel.