AI Control Library / CF-01: Lifecycle Governance
Designation: Core | Control types represented: Operational
Controls introduced only at production approval can arrive too late to influence data collection, architecture or supplier commitments. Retirement also creates risks when credentials, scheduled jobs or retained data outlive the service.
Control requirement
Define and apply control gates across AI proposal, design, acquisition, development, deployment, operation, change and retirement. Require stage-specific evidence and accountable decisions before a system progresses to consequential use.
Why this matters
The control is effective when its required decisions and safeguards can be demonstrated in the actual workflow. An approved document or completed form alone is insufficient if the described actions are not performed.
How the control types work together
Operational controls provide the policies, decisions and recurring processes described here.
When it applies
AI lifecycle activities, including iterative delivery, pilots, vendor features and systems moving between business uses.
Tailor depth and review frequency to potential impact, system authority and uncertainty. Document the reason for any exclusion; a supplemental designation does not make an otherwise applicable safeguard optional.
Ownership
The AI lifecycle owner defines gates; system owners provide evidence and designated authorities approve progression.
Implementation guidance
- Identify lifecycle stages and the decisions that commit data, resources or authority; include retirement and transfer of ownership.
- Assign controls, evidence and acceptance authority to each stage, with proportionate paths for low-impact experiments.
- Prevent stage progression without required evidence or a properly authorized exception; make iterative changes re-enter the relevant gates.
- Verify retirement removes access, jobs and integrations and addresses retained data, records and downstream dependencies.
How to verify it
Use a representative sample of actual records or an authorized controlled exercise. A reviewer with suitable expertise should compare observed practice with the approved scope and acceptance criteria.
| Test | Expected result |
|---|---|
| Trace a system through its stages | Required assessments and approvals precede the decisions they govern. |
| Expand a pilot into consequential use | The deployment gate is applied rather than inherited from experimental approval. |
| Inspect a retired system | Access, schedules and data disposition are reconciled. |
Record a finding when a required result is absent, evidence cannot substantiate the claim, or practice differs materially from the approved conditions. An exception may record accepted risk, but does not turn a failed safeguard into an effective one.
Evidence to retain
- Lifecycle model and gate criteria
- Stage evidence and decisions
- Exception records
- Retirement and handover records
Protect evidence according to its sensitivity and approved retention requirements. Retain enough detail to substantiate the assessment without unnecessarily duplicating confidential or personal information.
If the control fails
Escalate bypassed gates to the lifecycle authority. Pause the affected progression and assess already-created exposure; apply containment before completing retrospective documentation.
Example in practice
Hypothetical example: A research prototype is approved for synthetic data only. Connecting it to a live customer queue triggers a new deployment gate covering real data, oversight, monitoring and shutdown capability.
Related controls
- CF01-001: Governance Program Policy & Procedures
- CF01-008: AI Impact Assessment
- CF01-018: Post-Deployment Monitoring Plan
Framework mappings
- NIST AI RMF (MANAGE 1.1, MAP 2.2)
- EU AI Act (Art. 9(2))
- ISO 42001 (Cl. 8.2, A6.1)
Review and maintenance
Review at the interval approved by the control owner and after a material change, relevant incident or failed assessment. Reassess the affected scope, update records and verify corrective actions before closing findings.
Version 1.0