AI Life-Cycle Security Gates (ISO/IEC 5338)
Seven security gates across the AI system life cycle — inception, data, build, verification and validation, deployment, operation and retirement — with concrete pass criteria, so go-live and change decisions rest on evidence rather than optimism.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- ISO/IEC 5338 describes the processes of an AI system's life cycle, building on established software life-cycle processes and adding AI-specific ones such as data handling and continuous validation.
- This template turns those stages into seven gates with 32 concrete criteria — prompt-injection testing, data rights, model supply chain, rollback, monitoring and safe retirement among them.
- A material criterion marked Not met puts its gate on HOLD; otherwise the gate passes or passes with conditions.
- The generated record is the evidence trail a reviewer or auditor asks for when a system went live.
Frequently asked questions
What is ISO/IEC 5338?
It is the international standard for AI system life cycle processes. It adapts the familiar system and software life-cycle process model to AI, adding processes for things that are different about AI systems — acquiring and preparing data, building and evaluating models, and continuously validating a system whose behaviour can drift after deployment.
Do I have to use all seven gates?
Use the gates that match how you work, but do not skip the data and verification gates — most AI incidents trace back to data that should not have been used or attacks that were never tested. For a bought-in system, the data and build gates become questions to the supplier.
How does this relate to ISO/IEC 42001?
An AI management system expects responsible design, verification, deployment and monitoring of AI systems. Gate records like these are a practical way to show those activities happen for each system. The template is a starting point, not evidence of conformity on its own.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.