Chapter 5 : Introduction to the Lifecycle of AI

So what is the Lifecycle of AI?

The AI system lifecycle helps you understand the technical journey of an AI system—from initial planning to operation, monitoring, and sometimes retirement. While the process isn't always linear, each phase carries its own unique risks that can affect your system's performance, compliance, and user trust.

While different organizations and frameworks (like ISO or the OECD) offer slightly different versions of this lifecycle, we’ll stick to the NIST AI Risk Management Framework (RMF) throughout the book for consistency.

But let’s first look at how the OECD defines it.

OECD's Definition of the AI System Lifecycle

According to the OECD:

“The AI system lifecycle involves phases such as: i) Design, data, and models – a context-dependent sequence including planning, data collection, and model building; ii) Verification and validation; iii) Deployment; iv) Operation and monitoring.”

These phases happen iteratively—not always in order. AI systems can also be retired at any point during the operation and monitoring phase.

✅ Remember: Evaluating your AI system's lifecycle is essential for understanding where security, fairness, and data protection risks can arise.

Diagram of lifecycle stages of an AI system AI Terms and Concepts from OECD

A Closer Look at Phases of the AI Lifecycle

Understanding the lifecycle of an AI system is a crucial first step in analyzing its risks. Each phase of the lifecycle demands unique measures to ensure responsible AI practices. Gaining insight into the technical stages of the AI/ML project lifecycle is key to adopting a practice-based approach to AI ethics and safety. Different types of expertise are necessary to evaluate each stage of the AI lifecycle.

Measuring risk at different stages of the AI lifecycle can yield varying results, as some risks may emerge later as AI systems evolve. Different AI actors may have different risk perspectives. For example, an AI developer of pre-trained models may see risks differently than someone deploying the model in a specific context. Deployers might not recognize unique risks associated with their use case. All AI actors share the responsibility for ensuring the AI system is trustworthy and fit for its intended purpose.

Phase 1: Plan & Design

When starting an AI project, the team needs to decide whether to build a model from scratch or adopt an existing one. This depends on available resources, data, existing technologies, and the complexity of the problem. The model choice and model-adoption approach depend on the purpose of the AI system as well as where to acquire the necessary training data to feed the model during training.

Rather than developing a custom algorithmic model, teams can consider options such as:

• Proprietary Models: Some platforms offer customizable models that can be fine-tuned on specific datasets.

• Open Source Models: The open-source community contributes significantly to model development and transparency, offering adaptable and well-documented architectures.

• Cloud-Based Models: Cloud providers offer scalable models that integrate seamlessly into existing infrastructures and services.

The team must still set clear goals, understand stakeholder needs, and assess their capabilities. They should define what problem they're solving and how to measure success. At this point, it’s important to map out the impacted stakeholders who can be directly or indirectly affected by the deployment of an AI system or application.

The AI lifecycle begins with clearly defining the problem and understanding its context, objectives, stakeholders, and data requirements. Risk assessments and impact assessments remain essential to ensure fairness, security, and legal compliance.

✅ Steps to Take in this Phase:

Start by looking at the AI system’s whole “life story” — from the moment you think about building it to the day you retire it. For each stage, write down the key documents you’ll need. This helps you stay organized, play by the rules, and keep things transparent.

Initial impact assessment – Think of this as a “before-and-after” checkup for your AI. Before you launch it, and again after it’s running, look at how it might affect people, communities, the environment, and organizations. Don’t forget legal, ethical, and social angles.

Risk management inventory – AI risks aren’t one-size-fits-all, but they usually land in four main buckets:

• Data risks – Bad, biased, or stolen data.

• Model risks – Your AI makes mistakes or stops working well.

• Operational risks – Tech glitches, scaling issues, or poor upkeep.

• Ethical & legal risks – Breaking laws or being unfair.

If these risks aren’t handled, they can cost you money, damage your reputation, get you in trouble with regulators, make people lose trust, or even leak sensitive data.

Phase 2: Collect and Process Data

The first step after the design stage in the machine learning process is gathering relevant data from various sources. This data needs to be cleaned and transformed to ensure it's ready for analysis, which is crucial for building accurate machine learning models. Data can be collected through methods like web scraping, surveys, or legal agreements to obtain existing datasets.

Once you have your data, it's important to visualize the data and look at summary statistics to understand its structure. Key questions include: Are there missing values? Are there outliers or unexpected data points? Is the data balanced? This analysis helps you understand the data better and can inform further data collection and preparation steps.

Data labeling is another important step, where labels are added to raw data like images, videos, or text to categorize it for easier identification. Cleaning the data is crucial, especially for large datasets, as they often contain missing values or irrelevant information. Removing these helps improve the accuracy of your model and reduces errors and biases.

Types of Data Used in AI Systems

Understanding where your data comes from is key to managing risks and responsibilities in AI development. Here’s a breakdown of the five common types of data inputs used in training and operating AI systems based on OECD:

• Expert Input: This includes structured human knowledge, like ontologies, knowledge graphs, or analytic rules (e.g., objective functions or reward signals). Think of this as codified expertise—rules the model uses to make sense of the world.

• Provided Data: Data that people or organizations knowingly supply. This could be initiated (like filling out a license application), transactional (such as payment records), or posted (like a social media update).

• Observed Data: Captured through sensors or monitoring tools—think GPS location, website clicks, or temperature readings. This can be:

  • Engaged: like consenting to cookie tracking,

  • Unanticipated: like measuring how long you stare at a specific image, or

  • Passive: like CCTV footage in a public space.

• Synthetic Data: Artificially generated through simulations or models. This helps replicate rare or expensive scenarios—like crash testing a self-driving car virtually. Synthetic data mimics reality but is built algorithmically.

• Derived Data: Created by transforming existing data into something new. Examples include credit scores or risk ratings. These can be inferred (using probability models) or aggregated (from more granular inputs). Often, derived data is also proprietary.

Data Splits

Splitting your data correctly is key to training a successful machine learning model and avoiding a common problem called overfitting—this is when a model learns the data by heart instead of learning to understand different patterns.

To prevent this, you need to divide your data into three main parts:

Training Data: This should be the largest portion of your data. You use this to teach the model what to look for and how to make predictions.

Test Data: This is the second largest slice of your data. After training the model, you use this set to check how well it's performing and to make any necessary adjustments.

Validation Data: This is the smallest part of your data set and is used last. Once your model does well with the test data, you use the validation data to see how it handles completely new information.

It’s important to mix the data up randomly to avoid any bias, except in special cases like time series data where the order matters. This method helps ensure your model can handle real-world tasks and not just the examples it was trained on.

✅ Steps to Take in this Phase:

Before you train your AI, make sure your data is clean, safe, and legal to use.

Data anonymization – Remove or disguise personal details so no one can figure out who the data belongs to. Do this alongside cleaning and fixing the data fields so everything is correct and consistent. Training data can sometimes sneak in private info like medical records or confidential files, so double-check.

Legal agreements & lawful collection – Only use data you have the right to use. Get written agreements with data providers and make sure you’re collecting it in a way that follows the law.

Datasheets for datasets – Think of these like nutrition labels for your data. They show what’s inside the dataset:

• What kind of data it is

• How much of it you have

• Where it came from

• Who owns it

• Any copyright details

This helps you keep track of what you’re feeding your AI, makes it easier to explain to regulators, and builds trust with users.

You can check out the paper Datasheets for Datasets to get a sense of what to include in your datasheets.

Phase 3: Build and Use Model

Before an AI system can actually do anything useful, it needs to be trained — that’s just a fancy way of saying it learns from examples.

This happens in a controlled setting, like a lab or development environment. Think of it like teaching a kid using flashcards. You show the system lots of examples — texts, numbers, pictures — and it starts to learn patterns.

For example, let’s say you want to fine-tune a model to help diagnose medical conditions from X-ray images. You’d feed it a bunch of X-rays, each labeled with a diagnosis — like pneumonia, fracture, or normal. The algorithm (which is just a smart set of rules) begins to notice what pneumonia typically looks like, how a fracture appears, and so on. Over time, the model gets better at telling these apart on its own.

Once it’s trained, the model can look at new images and make a guess — just like a student who’s learned from enough flashcards and can now answer questions without help.

This whole process is often called “training” or “optimisation.” You decide what you want the model to do (like spot lung issues) and how you’ll check if it’s doing it well (such as accuracy or speed).

AI systems that use machine learning are everywhere now. Instead of giving the AI step-by-step instructions, machine learning lets it learn on its own by spotting patterns in data. You usually show the system a lot of examples with the right answers already labeled — like medical scans marked with the correct diagnosis — and it figures out the patterns.

Sometimes, you don’t give it any labeled answers. Instead, you let the system explore and learn by trial and error, kind of like learning how to ride a bike. This is useful when you don’t know the “right answer” for every example.

There are lots of ways to train models — from simple methods like decision trees and basic equations to more complex ones like deep neural networks (which mimic how our brains work). Whether your data is labeled or not changes how you train your model — but we covered that earlier in the section on data and metadata.

✅ Steps to Take in this Phase:

Model Cards: The Model’s Fact Sheet Once your AI model is ready, you need to explain it in plain terms — especially if it’s being used in important areas like healthcare, hiring, or safety-critical work.

That’s where model cards come in. Think of them like a product label or a fact sheet. They tell people:

• What the model is good at

• Where it might struggle

• How it should (and shouldn’t) be used

They’re not just for tech people. Developers can use them to improve systems, and non-technical folks — including regulators — can see how the model was trained, what kind of data it used, and any risks to be aware of.

Model cards are also great for spotting bias. For example, if the AI works well for some groups but not others — maybe it’s more accurate for certain skin tones — a model card can help flag it early. This kind of transparency pushes developers to think about fairness and accountability from day one.

They’re quickly becoming a must-have for responsible AI, and in some cases (like under the EU AI Act) they’re legally required.

📌 Tip: The Code of Practice for GPAI Providers is a great benchmark for what to include in your model card — worth checking out.

Phase 4: Verify and Validate

Ensuring your AI models work as expected is crucial. First, you need to train your model with data and then test it with new, unseen data to check its performance. This helps you see if the model can make accurate predictions outside of what it was directly taught. Fine-tuning the model using validation sets allows for adjustments to high-level aspects like hyperparameters, much like refining a recipe for the perfect taste. After these steps, evaluating the model by checking various performance metrics and documenting the process is essential for transparency and accountability.

✅ Steps to Take in this Phase:

Here’s a quick and friendly breakdown of common metrics people use to check how well an AI system is performing:

• Accuracy: Think of this as the “Did it get it right?” score. It's great for stuff like quizzes or yes/no questions, but for more creative tasks (like writing) — these compare the AI’s text to a “correct” version to see how close it gets.

• Precision: This one’s picky. It asks, “Out of all the times the model said something was right, how often was it actually right?” Good for making sure your AI isn’t too trigger-happy.

• Recall: Now we ask, “Did the AI miss anything important?” It looks at how good the model is at catching all the relevant stuff — even if it occasionally grabs the wrong thing.

• F1 Score: Can’t decide between precision and recall? The F1 score is like their lovechild — it balances both and gives you a single score to care about.

No need to get lost in math here. Just remember:

• High precision = less nonsense

• High recall = less missed stuff

• High F1 = a good mix of both

Overfitting and underfitting

• Overfitting Training for too many iterations on a limited dataset can make the model overly specialized, leading to poor performance on unseen data.

• Underfitting:Inadequate training or overly simple models may fail to capture the complexity of the task, resulting in general inaccuracies.

Validation ensures the model performs well and meets its goals, involving several steps: quality assurance, safety and compliance, and transparency. It guarantees the AI system produces high-quality results, operates safely, and meets compliance standards. Additionally, it provides clear information to stakeholders, reassuring them about the system’s reliability.

Training data contains biases (e.g., societal, cultural, or linguistic biases), the model may replicate or amplify these biases in its outputs. Understanding how your model makes decisions is vital. Tools like LIME and SHAP help explain the model’s predictions, identifying any biases or errors and ensuring fairness. By training, testing, fine-tuning, evaluating, and comparing models, you develop reliable AI systems that stakeholders can trust. This thorough validation process builds confidence in the AI's transparency, safety, and performance.

Phase 5: Deploy and Use

An AI model can be used in many different ways, and “inference” is the process of using an AI model –trained from data or manually encoded – to derive a prediction, recommendation or other outcome based on new data that the model was not trained on. People who will use the system must be trained to understand how it works, explain its decisions in simple terms, and ensure the outputs are high-quality, reliable, and fair.

Deterministic vs. Probabilistic Models

AI systems often rely on different modeling approaches depending on the type and certainty of available data. Two major types you'll encounter are:

• Deterministic Models: These operate based on fixed rules—think “if this, then that.” They always produce the same output given the same input. There's no ambiguity here; it's a predictable, one-outcome scenario.

• Probabilistic Models: These work in fuzzier territory. They explore multiple potential explanations for the data and calculate the likelihood of each. That means both the model and its outcomes come with a degree of uncertainty—but this uncertainty is measurable.

Probabilistic models allow you to optimize for performance metrics like confidence, robustness, or risk, using different inferencing techniques depending on your use case.

✅ Steps to Take in this Phase:

Train the People, Not Just the AI Once your AI system is live, it’s not enough to just set it and forget it — the people using it need training, too. And not just once. Keep a record of who got trained, what topics were covered, and when it happened.

Why? Because without proper AI literacy, users might blindly trust the system’s recommendations — even when something feels off. In high-stakes areas like healthcare or safety, this can lead to serious mistakes.

Training should include:

• How the system works (at a basic level)

• When to trust it — and when to question it

• The “do’s and don’ts” of using it (acceptable and prohibited uses)

• Any new documentation that applies after fine-tuning, not just what the original provider gave you

Deployment also means making sure the AI works smoothly with existing workflows, setting up connections with other applications, and planning for regular updates.

Phase 6: Operate and Monitor

Once your AI model is out in the real world, your job isn’t over. You’ve got to keep checking in to make sure it’s still doing what it’s supposed to do—and doing it responsibly.

Over time, things change. Maybe the data starts looking different, or users behave in new ways. This can cause something called model drift—basically, your AI starts getting things wrong because it’s working with data that feels unfamiliar. That’s why regular check-ups are key.

You should:

• Watch how the model is performing.

• Log what it’s doing (what data it’s using, what outputs it’s giving).

• Collect feedback from users.

• Track any weird or unintended behavior.

✅ Steps to Take in this Phase:

Sometimes, if performance drops too much, you’ll need to go back to earlier steps—like re-training the model or even rethinking parts of the design. In more serious cases, it might mean retiring the model completely.

Logging and record-keeping aren’t just helpful—they’re legally important too. Especially under rules like the EU AI Act, you need to keep proper logs and show that the AI is safe, fair, and working as promised.

Keep in mind: some logs might include sensitive data (like user info), so you’ll need to handle that carefully to avoid leaks or misuse.

Risk Management : Keep working on the risk management you started back in the planning phase. Once your system is out in the real world, unexpected risks will pop up—thanks to feedback, user behavior, and things you couldn’t have predicted. Don’t just notice them—log them in your risk register and update it regularly so you’re not caught off guard later.

Think of monitoring as your AI’s regular health check. It’s how you keep it sharp, ethical, and aligned with your goals over time.

Phase 6: De-commissioning & Retirement

At some point, you might decide to retire an AI system — maybe it’s outdated, not working as expected, or just no longer needed. But you can’t just unplug and forget about it.

When an AI system goes offline, it might impact people who rely on it. For example, in healthcare, shutting down a diagnosis model could confuse patients and doctors. Always give people a heads-up and make sure there’s a backup plan. There’s more to this than flipping a switch. You need to handle data responsibly, think about bias and fairness, take ownership of the decision, and be transparent. That way, you keep trust intact and avoid causing harm.

✅ Steps to Take in this Phase:

Before shutting things down, make sure you follow rules like GDPR and CCPA. That means safely deleting or archiving personal data tied to the AI. If you skip this step, you could leave serious privacy holes behind.

In short: AI offboarding needs care too. Do it right, and you show that your organization treats AI — and its impact on people — seriously.

Stay tuned for more and play some of our cool compliance games at 👇 https://play.compliancedetective.com/