Contents
Why think in terms of life cycle
Most AI incidents do not stem from a flawed algorithm at the outset, but from a system that drifts after it goes live: data that changes, a use that expands, monitoring that stops. Governing AI means controlling every stage, not just the launch.
The stages and their controls
| Stage | Key question | ISO/IEC 42001 control | Law 09-08 point of attention |
|---|---|---|---|
| Inception | Why this system, and is it feasible? | Documented requirements and specifications (A.6.2.2), impact assessment (A.5) | Specified and legitimate purpose (Article 3) |
| Data | What data, where does it come from, is it of good quality? | Acquisition, quality, provenance, preparation (A.7) | Legal basis (Article 4), proportionate data, filing with the CNDP (Morocco's data protection authority) |
| Design and development | What technical choices, what threats? | Design documentation (A.6.2.3) | Security of processing (Article 23) |
| Verification and validation | Does the system do what is expected, without unwanted effects? | Verification and validation measures and criteria (A.6.2.4) | Testing on dummy or pseudonymised data |
| Deployment | Are the conditions in place to go live? | Deployment plan (A.6.2.5), user documentation (A.8.2) | Informing individuals (Article 5) |
| Operation and monitoring | Does the system remain effective and safe? | Monitoring, maintenance, event logging (A.6.2.6, A.6.2.8) | No decision based solely on automated processing (Article 11) |
| Re-evaluation | Have the conditions changed? | Review of risks and impacts | New purpose: new filing |
| Retirement | How do you shut it down properly? | Retirement documentation | Deletion of data in line with the retention period |
Design: document the choices
ISO/IEC 42001 requires design choices to be documented: learning approach, model type, training data, evaluation, interface, human interaction. It also lists AI-specific threats to consider at this stage: data poisoning, model theft and model inversion, which makes it possible to recover training data from the system's outputs.
Validation: test in the real context
Test data must reflect the real domain of use. For a system intended for Morocco, that means testing with cases in French, Arabic and darija, and across a range of customer profiles. Go-live criteria must be set before testing, not after.
Operation: watch for drift
An AI system ages: customer behaviour shifts, products evolve, input data changes. Monitoring should track performance, complaints and differences in treatment between customer groups, and trigger revalidation when a threshold is crossed. Event logging should be enabled, at a minimum, for as long as the system is in use.
An external vendor does not transfer responsibility
If the system is bought from a vendor, the stages still exist. ISO/IEC 42001 requires responsibilities to be clearly allocated between the organisation, its suppliers and its customers (A.10). Require the vendor to provide technical documentation, test results and the intended conditions of use.
Practical checklist
- A named owner for each AI system in production.
- A record for each system: purpose, data, model, risks, measures.
- Go-live criteria set before testing.
- Monitoring with alert thresholds and revalidation.
- A retirement procedure that includes data deletion.
Further reading
- 4 min read
- 4 min read
- 4 min read
- 8 min read
Frequently asked questions
What are the stages of the AI system life cycle?
The generic model in ISO/IEC 22989 covers inception, design and development, verification and validation, deployment, operation and monitoring, continuous validation, re-evaluation, and retirement.
Do you need to manage the life cycle of an AI tool bought from a vendor?
Yes. The organisation using the system remains responsible for how it is used. It must obtain the necessary documentation from the vendor and allocate responsibilities clearly by contract.
What is model inversion?
It is an attack in which an AI system is queried in order to reconstruct information about the data used to train it. ISO/IEC 42001 lists it among the AI-specific threats to consider from the design stage.
General information, not legal advice.
Report an errorReferences (4)
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system. (opens in a new tab)
- ISO/IEC 22989:2022 — Artificial intelligence concepts and terminology. (opens in a new tab)
- ISO/IEC 5338:2023 — Artificial intelligence — AI system life cycle processes.
- Law No. 09-08 on the protection of individuals with regard to the processing of personal data (Dahir No. 1-09-15 of 18 February 2009), in particular Articles 4, 11, 43 and 44. (opens in a new tab)