AI lifecycle — policies, safety mindset, environmental impact
Primary statement
AI lifecycle per NIST AI RMF GOVERN-4.1 (critical-thinking + safety-first mindset) + GOVERN-2.1 (roles across lifecycle and actor types) + GenAI MG-1 (environmental impact) + EU AI Act + ISO 42001.
Audit-fatigue payoff
A unified lifecycle framework — policies + roles + safety mindset + environmental impact — satisfies lifecycle requirements across all 3 contributing frameworks.
Strictness matrix
Scope
Scope: roles AND responsibilities across AI lifecycle AND actor types — data acquisition, design, development, deployment, operation, monitoring, retirement.
Ceiling source: nist_ai_rmf:GOVERN-2.1
Rationale: NIST AI RMF GOVERN-2.1 lifecycle + actor-types scope is the broadest.
Threshold
Threshold: critical-thinking AND safety-first mindset fostered. Cultural threshold.
Ceiling source: nist_ai_rmf:GOVERN-4.1
Rationale: NIST AI RMF GOVERN-4.1 cultural threshold is uniquely strict.
Method
Method: lifecycle policies + practices + cultural mindset + roles per phase + environmental impact tracking (GenAI MG-1) + integration with ISO 42001 AIMS.
Ceiling source: nist_ai_rmf:GOVERN-2.1
Rationale: NIST AI RMF + GenAI MG-1 + ISO 42001 combined are most prescriptive.
Frequency
Lifecycle policy review annual. Mindset reinforcement continuous. Environmental impact tracking per training event.
Ceiling source: nist_ai_rmf:GOVERN-2.1
Rationale: Annual policy with continuous mindset is the cadence.
Evidence
Evidence: lifecycle policy + roles per phase + safety mindset evidence + environmental impact records.
Ceiling source: nist_ai_rmf:GOVERN-2.1
Rationale: NIST AI RMF GOVERN-2.1 evidence is comprehensive.
Auditor test pattern
Step 1: Inspect lifecycle policies. Step 2: Verify roles per phase. Step 3: Verify safety-first mindset evidence. Step 4: For generative AI, verify environmental impact tracking.
Common findings
Common findings: (1) Lifecycle covers development only; (2) Safety-first cultural rhetoric not operational; (3) Environmental impact ignored; (4) Operation phase under-resourced.