The AI lifecycle

Governance questions on the exam are often really order-of-operations questions. Know the lifecycle cold:

1. Plan and design: define the problem, decide whether AI is needed, identify stakeholders and affected people, classify risk.
2. Data collection and preparation: source, check rights, clean, label, assess for bias.
3. Model build and training: choose the approach, train, tune.
4. Test, verify and validate: performance, fairness, robustness, security, explainability.
5. Deploy: approve, release, document, inform users.
6. Operate and monitor: watch for drift, harms and misuse; retrain under change control.
7. Retire: decommission, handle data and documentation.

The lifecycle is a loop, not a line. Monitoring findings feed back into design and data.

Why start early

The cheapest place to fix a problem is in design. A risk found at stage 1 might mean "don't use AI here" or "use a simpler, explainable model". The same problem found after deployment can mean harm to people, regulatory action and a rebuild.

When a question asks what to do first, the answer is almost always in stage 1: define the use case, identify who is affected, and assess risk.

Builders vs buyers

Domain III of the exam covers the lifecycle for systems you develop. Domain IV covers systems you deploy or buy, where you control fewer stages but keep your own duties, especially assessment, oversight and monitoring.