Toolkit 6 - AI Lifecycle Control System
ISO/IEC 42001 formalises the expectation that organisations can clearly identify what AI exists, who owns it, how it is assessed, how it is monitored, how changes are controlled, and what evidence is retained. This toolkit is how you meet that expectation in practice.
An AI inventory is not just a spreadsheet. It is the anchor for risk management, supplier assurance, monitoring, transparency, and continuous improvement.
Available now
Paying by invoice or need a PO raised first? Request an invoice →
We'll send you a proforma invoice within 1 business day. Access is provided once payment clears, using the same automated delivery as a card purchase.
🔒 Secure checkout via Lemon Squeezy ⚡ Instant delivery to your email 📄 7-day refund policy 🧾 Price includes UK VAT 👤 Your governance data stays with you
Outputs may be shared with auditors, customers, regulators, and advisers for assurance.
After using this toolkit you will have
- A current AI inventory with ownership, risk classification, lifecycle stage, and evidence pointers for every AI system
- Defensible AISIA records showing proportionate assessment of each AI system before it progresses
- Stage-gated lifecycle records for all seven stages, from design and scoping to retirement, each with entry and exit gate criteria
- Model documentation (model cards) suitable for assurance conversations with customers, auditors, and leadership
- A clean audit trail linking each AI system (AI-001) to its assessment, risks, controls and evidence
Designed for
- Organisations using AI across functions - including vendor AI and embedded AI features
- Teams needing ISO/IEC 42001-aligned lifecycle artefacts without building a platform
- Governance, data, AI leads, InfoSec, and internal audit teams
- Organisations preparing to answer "what AI do you have and how is it governed?"
- Teams dealing with shadow AI, untracked vendor tools, and uneven AI adoption
What this solves
Most organisations cannot answer three basic questions about their AI: what AI do we have, who owns it, and what evidence do we have across its lifecycle.
Auditors start with scope and inventory. If you cannot point to a current, maintained AI register with ownership and lifecycle status, the audit conversation becomes difficult before you have presented a single control.
This toolkit gives you the structure to answer those questions, and the artefacts to demonstrate that you are managing AI responsibly throughout its operational life.
Specifically, it addresses:
- No structured AI inventory - shadow AI, undocumented vendor tools, and untracked deployments
- No proportionate intake gate - AI systems entering production without documented assessment
- No lifecycle evidence - nothing to show at validation, deployment, or monitoring stages
- No model documentation - inability to explain what an AI system does, its limitations, or how it is monitored
- No supplier AI governance - vendor tools treated as "just software" without assurance evidence
Decision support only. Not a certification scheme and does not guarantee certification outcomes.
How it works
Simple five-step workflow
- Populate the AI Inventory - log every AI system including vendor AI and embedded AI features. Include shadow AI discovered during the exercise
- Run AISIA triage - complete the Short Form for each new or changed system; for High or Critical systems, complete the Full Assessment
- Complete lifecycle artefacts - proportionate to the risk classification; Low systems need less, High and Critical systems need more
- Maintain monitoring evidence - performance signals, drift reviews, incidents, change records
- Link to your evidence library - inventory entries connect to risk register entries (Toolkit 5) and to your evidence spine (Toolkit 2)
AISIA triage workflow
Every new AI system or material change triggers an AISIA. The Triage Short Form takes 10-20 minutes. It scores nine signals, checks a vulnerable-groups flag and seven trigger overrides, and places the system in one of four tiers (Low / Medium / High / Critical) that sets the depth of lifecycle evidence required.
- Low / Medium - Triage Short Form, Short Form Model Card and an inventory entry
- High - Full AISIA with its weighted scoring matrix, Long Form Model Card and stage records for each stage reached
- Critical - the High route plus senior sign-off before the system progresses
Everything included - 16 files
Contents at a glance: 1 guide, 1 inventory workbook, 2 AISIA forms, 2 model cards, 7 lifecycle stage records, 1 supplier AI template, 1 coverage map and the licence terms. 2 PDF, 12 DOCX and 2 XLSX.
Toolkit 6 is the lifecycle operations layer: AI inventory, AISIA, model cards, lifecycle stage records and supplier AI mapping. Risk scoring, treatment and residual acceptance sit in Toolkit 5 - Unified AI & Security Risk System, or get both in the AI Risk & Lifecycle Control bundle.
Guide and inventory
-
Start Here - Toolkit 6 PDF
Orientation guide, operating flow and file map.
-
AI Inventory Workbook XLSX
AI inventory, Model_Register, supplier AI mapping, data lineage and classification reference.
AISIA and model documentation
-
AISIA Triage Short Form DOCX
Rapid intake gate: nine scored signals, a vulnerable-groups flag and seven trigger overrides.
-
AISIA Full Assessment DOCX
Full impact assessment with a seven-dimension weighted scoring matrix mapped to the four tiers.
-
Model Card Short Form DOCX
Concise model card for proportionate documentation.
-
Model Card Long Form DOCX
Full model card for higher-risk systems, including security and operational requirements.
Lifecycle stage records - each with entry and exit gate criteria
- Lifecycle Stage 1 - Design and Scoping DOCX
- Lifecycle Stage 2 - Development and Procurement DOCX
- Lifecycle Stage 3 - Validation and Testing DOCX
- Lifecycle Stage 4 - Deployment DOCX
- Lifecycle Stage 5 - Monitoring and Operations DOCX
- Lifecycle Stage 6 - Change Control DOCX
- Lifecycle Stage 7 - Retirement and Decommissioning DOCX
Supplier AI, coverage and licence
-
Supplier AI Mapping Template DOCX
Assurance record for supplier-provided and embedded AI.
-
ISO Lifecycle Coverage Map XLSX
Shows which file covers each ISO/IEC 42001 lifecycle expectation.
-
Licence, Use, Refund and IP Terms - Toolkit 6 PDF
Permitted use, restrictions and IP boundaries for this toolkit.
Sample preview slice
This preview describes the lifecycle evidence shape without exposing the underlying templates or worked examples.
- AI inventory fields for ownership, purpose, lifecycle stage, risk status and evidence pointers.
- AISIA gate structure for intake, escalation, approval and monitoring requirements.
- Model-card and stage-gate record outline from design and scoping through retirement.
Outputs and evidence you can generate
- A current AI inventory auditors can scope against - ownership, risk classification, lifecycle stage, and evidence pointers for every system
- AISIA artefacts demonstrating proportionate governance assessment for each system
- Lifecycle evidence at every stage you have reached - design decisions, validation results, deployment checklists, monitoring logs, change records, retirement records
- Model documentation (model cards) suitable for assurance conversations with customers, leadership, and auditors
- Supplier AI assurance records demonstrating due diligence on vendor tools
- A dashboard view of inventory health: systems by status, risk level, AISIA completion, and upcoming reviews
ISO/IEC 42001 alignment
This toolkit directly addresses the ISO/IEC 42001 requirements that most organisations find hardest to evidence:
- Clause 6.1.4 and 8.4 (AI system impact assessment) - AISIA Triage Short Form and Full Assessment
- Clause 6.1.2 (AI risk assessment) - AISIA outcomes feed risk identification, in Toolkit 5 if used
- Clause 8.1 (Operational planning and control) - lifecycle stage records and gates
- Clause 9.1 (Monitoring, measurement, analysis and evaluation) - Lifecycle Stage 5 and inventory monitoring fields
- Annex A.5 (Assessing impacts of AI systems) - AISIA forms and records
- Annex A.6 (AI system life cycle) - all seven lifecycle stage records
- Annex A.10 (Third-party and customer relationships) - Supplier AI Mapping Template
Where it fits in the system
Toolkit 6 is your scope control and evidence factory. It gives you the artefacts that make ISO/IEC 42001 real in day-to-day operations, and it integrates cleanly with ISO 27001 documentation and governance.
Each AI system carries one System ID (AI-001) and records its linked Risk IDs from Toolkit 5 (if used). Stage records provide evidence for risk treatments and monitoring, and Evidence IDs connect to your evidence spine in Toolkit 2. Toolkit 5 governs AI risk. Toolkit 6 proves AI systems remain controlled. Both work standalone.
Licence summary (plain English)
- Licensed to a single legal entity (the purchasing organisation)
- Authorised users include employees and individual contractors acting on your behalf
- Outputs (completed inventories, AISIA records, lifecycle stage records, model cards) may be shared with auditors, customers, regulators, and advisers for assurance
- Toolkit template files may not be shared, resold, or reused as a commercial method across other organisations
- Internal customisation and population for your own organisation is permitted
When this is not for you
- You want a simple list of tools without governance fields or evidence linkage
- You do not intend to maintain the inventory as AI systems change - an inventory that is not updated creates more risk than no inventory
- You are looking for a technical MLOps platform rather than governance artefacts
- You want certification guarantees rather than structured evidence generation
Procurement justification
This purchase supports implementation of structured AI lifecycle governance controls across intake, approval, deployment, monitoring, review, change and retirement activities.
The toolkit provides reusable lifecycle workflows, AI inventory structures, impact assessment routes, model documentation and lifecycle evidence templates intended to support controlled and auditable AI system oversight.
The materials can be implemented internally by AI governance, product, data, security, risk, compliance and assurance teams to strengthen ownership, approval records and lifecycle accountability.
This is a one-off digital toolkit purchase. The supplier does not require access to our AI inventories, AI systems, prompts, models, datasets, source code, customer records, production environments, internal systems or completed evidence to fulfil this purchase.
The purchase is proportionate because it gives our organisation a reusable lifecycle control system without requiring a hosted platform or bespoke operational governance build.
Designed for internal approval and governance workflows.
Frequently asked questions
Is this only for machine learning models?
No. It covers AI systems broadly - including vendor AI tools, embedded AI features in SaaS products, generative AI, rules-based systems, and internal builds. If an AI system is in scope for your governance, it belongs in the inventory.
Do we need to document every system at the same level?
No. The AISIA triage drives proportionality. Low and Medium tier systems get a light touch - the Triage Short Form and Short Form Model Card. High and Critical systems get the full treatment. You document to the level the risk justifies.
What is an AISIA?
An AI System Impact Assessment. It is the intake gate that determines what lifecycle evidence a system requires. The Triage Short Form takes 10-20 minutes and places the system in one of four tiers: Low, Medium, High or Critical. The Full Assessment is for High and Critical systems and takes 60-90 minutes.
How does this help with audits?
Auditors typically start with inventory and scope. This toolkit provides inventory, AISIA artefacts, lifecycle evidence structure, and model documentation - four evidence areas commonly expected in ISO/IEC 42001 audit preparation.
How does this connect to Toolkit 5?
Through IDs, not duplicated records. Each AI risk in the Toolkit 5 register records the System ID and AISIA reference, and each Toolkit 6 inventory entry records its linked Risk IDs. AISIA outcomes feed risk identification, and stage records provide evidence for risk treatments and monitoring triggers. Each toolkit also works on its own.
Does it include worked examples?
Yes. The AI Inventory Workbook includes three worked examples across financial services scenarios: a credit risk scoring model, a legal document review assistant, and a customer service chatbot. The lifecycle stage records and Model Card Long Form also include worked examples throughout.
Is this a certification scheme?
No. It supports ISO/IEC 42001 alignment and produces audit-ready artefacts, but does not constitute certification or guarantee certification outcomes.
How does payment work and who processes it?
Payment is processed securely by Lemon Squeezy, who act as merchant of record for AIBI Systems. Your payment, VAT collection, and any post-sale compliance are handled directly by Lemon Squeezy. Your download link is delivered to your email immediately after payment. All prices shown are inclusive of VAT.
Best pairing: AI Risk & Lifecycle Control bundle
Toolkit 6 gives you the lifecycle evidence trail. Toolkit 5 gives you the AI risk method: scoring, treatment, residual acceptance and risk owners. Together they connect every AI system to scored risk and a stage-gated lifecycle record.
Or get Toolkit 1 through Toolkit 6 in the Complete System Bundle.
Toolkit 6 - AI Lifecycle Control System
Control AI from design to retirement. Audit-ready evidence at every stage.
Instant download. One-off purchase. Outputs may be shared with auditors, customers, regulators, and advisers for assurance.