One map for everything

Lesson 1 of 5 in The AI Lifecycle: From Data to Deployment to Retirement.

Ask where an AI system went wrong and you are really asking when. The résumé screener that discriminates was usually broken at the data stage, years before launch. The chatbot that leaks customer records failed at deployment configuration. The fraud model that quietly stopped working failed at monitoring — or rather, monitoring failed to exist.

This is why every serious governance framework — the OECD’s AI system lifecycle, NIST’s AI Risk Management Framework, ISO/IEC 42001, the EU AI Act’s obligations — is organised around the same backbone: the AI lifecycle. Learn it once and you can navigate all of them, because each framework is essentially a list of duties pinned to lifecycle stages.

The AI lifecycle — seven stages, one loop

  1. 1. Plan & design

    Frame the problem, ask should we build this at all?, choose build vs buy vs fine-tune vs API, run the design-stage risk assessment.

  2. 2. Collect & process data

    Source, license, clean, label, and document the data. Representativeness and lawful basis are decided here — and so is most future bias.

  3. 3. Build & train the model

    Pre-training, fine-tuning, alignment. Compute is spent, checkpoints are versioned, design choices harden into behaviour.

  4. 4. Verify & validate

    Benchmarks, red-teaming, bias audits, safety evaluations. Documentation artifacts (model cards, test reports) are produced.

  5. Ready to release?

    The pre-deployment gate: conformity assessment, impact assessment sign-off, go/no-go. The last moment when saying no is cheap.

  6. 5. Deploy

    Release strategy, integration, human-oversight configuration, user disclosure. The system meets the real world.

  7. 6. Operate & monitor

    Watch for drift, log decisions, detect and respond to incidents, decide when to retrain. Usually the longest stage.

  8. 7. Retire

    Deprecate, migrate dependants, delete data on schedule, keep decommissioning records for accountability.

Notice the two arrows that point backwards. A failed evaluation sends you back to data and training. Monitoring findings trigger retraining. And there is a third loop the diagram cannot draw: a deployed model’s outputs — its approvals, its generated text — leak back into the world and become part of tomorrow’s training data. The lifecycle is a circle, not a line, which is why governance frameworks refuse to treat launch as the finish line.

Two ideas turn this map into a professional tool:

  1. Every failure has a stage address. When you analyse an incident, your first question is which stage produced the flaw and which stage should have caught it. Different addresses demand different fixes — you cannot monitor your way out of a data problem.
  2. Shift-left governance. The earlier a control operates, the cheaper it is. A use-case veto at design costs a meeting. The same veto after deployment costs a recall, a regulator letter, and the front page. Frameworks push obligations upstream for exactly this reason.

Key terms: AI lifecycle, shift left, post-market monitoring, impact assessment

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.