Operational planning and AI lifecycle controls

Clause 8 requires the organization to plan, implement, and control the processes necessary to meet AI system requirements and address identified risks. It focuses on managing the entire AI system life cycle—from initial conception and data acquisition through development, deployment, operation, and eventual decommissioning.

What it means

In practice, this clause transforms your high-level AI policy and risk assessments into a repeatable operational workflow. Rather than treating AI development as an ad-hoc project, you must establish a structured "AI Life Cycle" that ensures controls are applied at every stage of the system's existence.

This requirement bridges the gap between planning (Clause 6) and performance evaluation (Clause 9). If your risk assessment identified potential algorithmic bias or data privacy concerns, Clause 8 is where you implement the specific technical checks, validation steps, and monitoring tools to mitigate those risks during actual production.

Furthermore, it requires strict control over changes. Because AI systems can exhibit "drift" or behave unexpectedly after retraining on new data, operational planning must include mechanisms to manage these updates without introducing new unmanaged risks into the environment.

How to meet it

Define a formal AI System Life Cycle framework that documents each stage: design, development, testing, deployment, operation, and retirement.
Integrate your risk treatment plan directly into the development pipeline, ensuring specific mitigation tasks are assigned to stages of the life cycle.
Establish "quality gates" or mandatory sign-off criteria that a system must meet before moving from one stage (e.g., testing) to the next (e.g., production).
Implement technical controls for data provenance and quality management to ensure training and testing datasets are fit for purpose.
Create a standardized process for monitoring AI performance in production, including triggers for when a model needs to be retrained or taken offline.
Document a decommissioning procedure to safely retire AI systems, ensuring data is handled correctly and dependencies are managed.

Evidence an auditor asks for

A documented AI Life Cycle Policy or Standard Operating Procedure (SOP).
Project management records showing that risk mitigation steps were actually performed during the build phase.
Validation and verification reports, including results from bias testing, accuracy benchmarks, and security scans.
Change management logs detailing updates to models, hyperparameters, or training datasets.
Deployment checklists signed off by authorized personnel before a system went live.

Common pitfalls

Treating AI like traditional software: Failing to account for the non-deterministic nature of AI (e.g., ignoring model drift and retraining needs).
"Paper compliance": Having a risk register that lists threats, but having no evidence that those risks were actually checked or mitigated during the development process.
Shadow AI: Implementing operational controls only for official projects while ignoring experimental or "prototype" systems running in production environments.