MR-070 Governance & process Organization scope

Inadequate AI decommissioning and retirement

The deployer has no managed process for retiring or decommissioning AI systems and models, so deprecated or unsupported systems remain in use and accumulate risk and liability.

Risk family: Governance & process
MIT domain: n/a (ISO-derived)
MIT subdomain: n/a
AI type: GPAI, Classical_ML, Agentic
Scope: Organization
Source standard: ISO/IEC 23894 + 42001 (gap analysis)

Provenance

Source standard

ISO/IEC 23894 + 42001 (gap analysis)

Source frameworks

ISO/IEC 42001:2023, ISO/IEC 23894:2023

ISO/IEC references

23894 Annex B.7; 42001 Annex A, A.6 and A.4.6

Nearest MIT-derived risk

MR-047 Vendor/model concentration / MR-058 drift: neither addresses end-of-life governance of an AI system.

Framework crosswalk

Every framework item mapped to this risk. Items marked partial overlap only in part; definitions appear on hover where the source licence permits.

Sourcesframeworks that contributed to the register

ISO 420012

A.4.6 ISO/IEC 42001 Annex A A.4.6
A.6 ISO/IEC 42001 Annex A A.6

More in Governance & process

MR-037 MR-042 MR-043 MR-045 MR-046 MR-054 MR-062 MR-063 MR-066 MR-067 MR-068 MR-069

Part of the Deployer AI Risk Register, an open-source resource developed by MindXO. Version 1.0, 3 July 2026. Derived from the MIT AI Risk Repository (V4, December 2025) under CC BY 4.0; an independent derivative work, not endorsed by or affiliated with MIT. Sub-risk decomposition references MITRE ATLAS™ v5.6.0 (© 2021-2026 The MITRE Corporation, reproduced and distributed with permission). ISO/IEC and EU AI Act references are by number only. License: CC BY 4.0. Full attribution and licensing.