AI Life Cycle and AI Risk Management
Life cycle stages
A defensible life cycle runs: problem definition and business understanding → data sourcing and assessment → data preparation → model development and selection → validation and testing → deployment → monitoring and maintenance → decommissioning. Governance hooks attach to each stage: data provenance and lawful basis at sourcing; documentation and approval gates before deployment; drift detection, incident response and periodic revalidation after deployment; archival and model retirement at the end.
Risk management mechanics
Know the NIST AI RMF functions - Govern (culture, accountability, policies), Map (context, stakeholders, affected parties), Measure (testing, metrics, bias and safety evaluation), Manage (prioritise, treat, monitor) - and that Govern is continuous, not a phase. Risks are characterised as likelihood × impact, distinguished as inherent versus residual after controls, and held against a stated risk appetite and tolerance. Controls include human review, red teaming, bias and adversarial testing, logging and audit trails, access controls, model cards and datasheets for datasets. Escalation typically follows a three-lines-of-defence model: product teams own risk, risk/compliance functions oversee, internal audit assures. Financial services candidates should recognise SR 11-7-style model risk management: inventory, validation, ongoing monitoring.
Assessments
An AI impact assessment examines rights, safety, fairness and societal effects; a DPIA examines personal-data processing; a fundamental rights impact assessment is the AI Act's high-risk variant. A vendor assessment covers third-party and supply-chain risk - using a vendor model does not transfer accountability.
Worked example
A team proposes an LLM-based HR screening tool. Map: affected parties are applicants. Measure: test for disparate impact across protected groups and for hallucinated justifications. Manage: human review before rejection, logging, and a quarterly re-test. Trap: approving once and never re-testing - drift and prompt or model changes invalidate prior assurance.