The pipeline runs from task definition through data, modelling, verification, deployment and operation, with risk, security, accountability and safety applying across the whole of it.
What the base framework establishes
The clause introduces the pipeline that the rest of clause 8 describes. Before the pipeline starts, the task must be defined, including input and output formats, because that definition drives algorithm choice and data acquisition. The pipeline stages are then described, and the clause says four concerns apply across all of them: risk management and governance; security and privacy; accountability, transparency and explainability; and safety, resilience, robustness and fairness. It also notes that the preparatory steps can run in a different order or together, depending on the constraints of the case.
Why it matters to an AI management system
This is the most useful governance sentence in the base framework. It says the four cross-cutting concerns are not a phase at the end; they apply at every stage. A record that addresses risk only at deployment has misread the framework, and an auditor can say so with the clause in hand.
The public draft summary names no change to 8.1 General. The final text could still touch it.
Evidence a reviewer samples
| Category | Artefact |
|---|---|
| Pipeline map | Each stage, its owner and the control applied at that stage. |
| Cross-cutting matrix | Risk, security, accountability and safety mapped to every stage. |
| Task definition | The problem and the input and output formats that start the pipeline. |
One question to prepare for. At which pipeline stage is each of the four cross-cutting concerns actually controlled?
Common gaps
- Risk is assessed once, before go-live, and never at data acquisition or operation.
- Security is treated as an infrastructure concern with no pipeline owner.
- The pipeline map stops at deployment and has no operation stage.
Prepare before publication
Draw the pipeline with the four cross-cutting concerns as columns and name an owner for each cell. Use it as the index to the evidence.
Dates that matter
No separate date attaches to 8.1; the record dates are the stage date, the planning estimate and the CEN expectation stated above.
Cross-references
5 Overview · 6.2 Task · 8.2 Data acquisition · 8.7 Operation
Source
Source for 8.1: ISO/IEC 23053:2022, clause 8.1. The public sample stops before 8.1, so this page relies on the public contents and the public summary and does not quote the clause. The two official records are linked on this page so any line can be checked.
Not legal advice; does not certify. A reading of the framework and the evidence a reviewer commonly samples, not a substitute for the standard or your auditor's rules.