Description
Separation of conflicting responsibilities in AI lifecycle (development, testing, approval, monitoring) to prevent conflicts of interest.
Implementation Guidance
Separation Requirements
Ensure the following separations: developers cannot approve their own models for production, data scientists cannot independently validate their own model outputs, business sponsors cannot waive testing requirements, and monitoring teams report independently from development.
Technical Enforcement
Implement access controls in MLOps platforms enforcing separation: separate development and production environments, approval gates requiring different users, code review requirements before model promotion, and audit logs tracking who performed each lifecycle action.
Compensating Controls
For small teams where full separation is impractical, implement compensating controls: mandatory peer review, automated validation checks, management sign-off requirements, and documented risk acceptance for any separation gaps.
Evidence Requirements
- Segregation of duties matrix for AI lifecycle
- Access control configurations enforcing separation
- Code review and approval records showing different actors
- Compensating control documentation (if applicable)