The standard does not prescribe a life cycle model but expects one, built with ISO/IEC 15288, 12207 and 15289 as useful references, whose stages can repeat and iterate. Considerations that should run from beginning to end are governance implications of developing or using AI, privacy and security implications of large and sometimes sensitive data, security threats arising from data-dependent development, and transparency and explainability, covering data provenance and the capacity to explain outputs. The model allows for the ways AI systems differ from conventional software: data-driven training rather than precisely specified behaviour, lower predictability, statistical rather than verifiable performance assessment, many iterations to reach acceptable performance, data management as a central process, and release management that versions code, models and training data together.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.