AI Governance Map

Using an LLM pipeline, we assessed each document in CSET Emerging Technology Observatory's AGORA dataset for coverage of each of the 6 stages of the AI Lifecycle, as defined in the OECD Framework for the Classification of AI Systems. See the pilot blog post for discussion of the methodology.
Stages range from Plan and Design through Operate and Monitor, with documents potentially covering single stages, multiple stages, or the entire lifecycle.

Insights from AI Lifecycle Analysis:

• A post-hoc framing of AI risks. Risks are mentioned most frequently during the ”Deploy” and “Operation and Monitor” stages of governance documents instead of the “Collect and Process Data” stage.
• Risks consistently recognized across the lifecycle. A subset of risks that pertain broadly to AI systems are recognized across all six AI lifecycle stages. These include AI system security vulnerabilities and attacks (2.2), Lack of capability or robustness (7.3), Governance failure (6.5)*, Compromise of privacy (2.1), and Lack of transparency or interpretability (7.4). The prominence of these risks across stages indicates sustained regulatory attention to model safety and system-level concerns throughout the AI lifecycle.
• Risks and sectors persistently underrepresented across stages. By contrast, societal risks and risks specific to frontier AI tend to be underrepresented or mapped to only a limited number of lifecycle stages. Accommodation, Food, and Other Services, Arts, Entertainment, and Recreation, Real Estate and Rental and Leasing, and Agriculture, Mining, Construction and Manufacturing, receive comparatively limited coverage across lifecycle stages. Together, these patterns suggest that certain categories of risk remain marginal in governance discussions at multiple points in the AI lifecycle. 
• Policy implication. This post-hoc framing indicates that current governance approaches tend to prioritize downstream controls over early-stage intervention. Strengthening attention to socioeconomic and risk-related considerations during the Collect and Process Data stage may help frontload risk mitigation requirements and embed risk management as a foundational component of the AI innovation process, rather than as a reactive or compliance-driven step.