AI and information asset lifecycle management runs on the Company Workspace. Use it together with the step results (documents) of ICT Management System Operation Guide; here you keep the data for each AI system (evaluation scores, measured values, gate judgments, incidents). How the storage is protected is described in the Information Security Guide.
AI and information asset lifecycle management: gates at each stage from initiation to disposal

Initiation and requirements, design and development, verification and validation, deployment, operation and monitoring, disposal. When moving between stages, "Review needed" appears if the previous gate has not been judged, or if there is no approved AI risk assessment or impact assessment when moving to deployment or operation. The performance at validation is set as the baseline, and performance in use is watched with control charts (EWMA, CUSUM) to detect drift.

Companies that operate ISO/IEC 27001 (information security) also use this screen. Choose "ISO/IEC 27001 Information security" in the standards above and enter the information assets (the ICT step 4 list), the information security risk assessment (likelihood × impact, method ISO/IEC 27005:2022), information security incidents, events and vulnerabilities (A.5.24 to A.5.28 · A.6.8 · A.8.8), and the change, supplier and secure development gates (A.8.32 · A.5.19 to A.5.23 · A.8.25 to A.8.29). The risk treatment and Statement of Applicability (SoA) are kept as ICT step 7 documents (ICT Management System Operation pass · ISO/IEC 27001).

ICT operation stepWhat you do on this screenISO/IEC 42001
4 AI System InventoryList of AI systems, owners and lifecycle stage4.3 · Annex A.4
5 AI Risk AssessmentLikelihood × severity (1 to 5), grade (critical, high, medium, low), treatment and re-evaluation after action6.1.2 · 8.2
6 AI System Impact AssessmentAffected individuals, groups and society; impact areas (fundamental rights, safety, fairness, privacy …)6.1.4 · 8.4 (method ISO/IEC 42005:2025)
8 Verification and Use ApprovalLifecycle gates (check items, judgment, approver)Annex A.6
11 Monitoring, Change and Revision ControlIndicators for performance, drift, fairness and data quality, validation baseline, control charts, AI incidents and complaints9.1 · 10.2
Standard edition: ISO/IEC 42001:2023 (iso.org, checked 2026-10-24). The impact assessment method is ISO/IEC 42005:2025. The Annex A control numbers are being checked against the original text, and until confirmed they are written by area name.
Principles we keep: Calculations and judgments are for reference, and the final decision is made by your company. Names and content are encrypted with a different key for each company, while numbers, scores, measured values and judgments are kept as they are so that they can be analyzed. An approved evaluation is not edited but replaced with a new version, and the change history is kept.

My AI systems

Loading…