The AI system lifecycle, stage by stage
The abstract asks for privacy risk to be identified throughout the lifecycle. The stages used here are inception, design and development, deployment, operation and monitoring, and retirement, as ISO/IEC 22989 names them.
What this page covers
- Inception: the purpose, the people affected and the data are first described.
- Design and development: the data is acquired, prepared and used to train or configure the system.
- Deployment: the system is put into use and the notice, retention and logs are set.
- Operation and monitoring: the system meets real data, prompts, outputs and human overrides.
- Retirement: the model, the data and the logs are deleted or archived under a recorded decision.
How to use it
Walk the register stage by stage and ask what personal data appears, who decided it and where it is kept. A stage with no answer is the next piece of work.
What it does not add
The stage names are from the published terminology standard. The draft does not publish its own list, so this page does not attribute one to it.
The mapping of the abstract to these stages is our reading, labelled as such.
Read across
Source for this reference page: ISO/IEC 22989:2022, Artificial intelligence, Concepts and terminology, retrieved 22 October 2026. The note is limited to what the public record states. Every source.