The Operation domain covers the full lifecycle of AI systems — from design through deployment, monitoring, and decommissioning. It is the largest domain in Annex A and where most of an organisation's AI risk either gets managed or left unaddressed.
Operation spans Annex A controls A.5, A.6, and A.7.
Before deploying an AI system, the organisation must assess its potential impacts — including harms to individuals, groups, or society. Impact assessments must be proportionate to the risk profile of the system and documented.
The organisation must manage AI systems across their full lifecycle: design, development, testing, deployment, monitoring, and decommissioning. Each stage requires appropriate controls, documentation, and oversight. Systems must not continue to operate beyond their useful or safe life.
The organisation must manage data used in AI systems responsibly. This includes data quality, data governance, data provenance, and ensuring that data is appropriate for its intended use. Poor data quality is one of the most common sources of harmful or biased AI outputs.
The Operation domain is where policy becomes practice. An organisation may have excellent Governance and Organisation controls, but if AI systems are developed and deployed without impact assessments, lifecycle controls, or data governance, the risk cannot be managed effectively.
- How does the organisation assess the impact of AI systems before deployment?
- What lifecycle controls exist for AI systems in development and in production?
- How is data quality assessed and managed for AI training and operation?
- Are decommissioning processes defined for AI systems no longer in use?
| Operation output | Used by |
|---|---|
| Impact assessments | Relationships domain — informing third-party obligations |
| Lifecycle records | Clause 9 (Performance Evaluation) |
| Data governance | A.7, Clause 6 (Planning — risk treatment) |
Reference catalogue entry — use this as source material for matching funny and professional infographic cards.