Governed at every step. Classified, tested, guarded — spend capped.

The AI lifecycle is the full path an AI use case travels from idea to production and beyond: discovery, risk classification, risk assessment, evaluation and red teaming, runtime deployment, guardrail enforcement, and ongoing observability. In a mature AI programme these steps form a governed loop rather than a one-way project — every production signal feeds back into classification, testing and cost control.

Kosmoy provides a tool and a control surface at every step. Shadow-AI discovery finds unsanctioned systems and enters them into the loop; risk classification and assessment set the obligations; evaluation and red teaming test quality and safety; the gateway and Action Capsules run and contain the system; guardrails block harmful calls; and monitoring observes behaviour and caps spend. Because they share one identity model, one policy model and one audit trail, a decision made at one step is visible and enforced at the others.

At step three — after a use case is classified and its risks assessed, but before it goes live. Quality is scored against a dataset, then the system is attacked for robustness. The findings do not sit in a report: remediation flows into the guardrails at step five, and once the system is in production, online evaluation reads real traffic from the observability layer. Testing becomes continuous rather than a one-time gate.

The maturity frontier, as framed by converging guidance from Gartner (AI TRiSM), Forrester, the NIST AI RMF, OWASP and the FinOps Foundation, moves an organisation from scattered lists to one registry, from perimeter security to agent-level control, from ad-hoc testing to evals and red teaming on demand, and from manual audit evidence to classification on demand. Kosmoy is built to close that gap across all ten capabilities at once, in the customer's own infrastructure.

Shadow AI — unsanctioned models, agents and assistants — is the entry point to the loop, not an exception to it. Continuous discovery reconciles agents from Azure AI Foundry, Bedrock, Vertex, Salesforce and ServiceNow into one master registry; each newly found system enters at step one, gets classified and assessed, and joins the same governed lifecycle as everything built in-house.

The AI operating loop is the six-step cycle a governed AI system runs continuously: register and classify, assess risk, evaluate and red team, deploy and contain, enforce guardrails, then observe and cap spend — with step six feeding back into classification and testing. Govern is not a phase that ends at launch; it is a loop the four platform layers — AI Inventory, AI Monitoring, AI Governance and AI Action Control — run for every system, every day.

Every step leaves a record in the same audit trail: the classification decision, the documented risk assessment, evaluation and red-team results, deployment and containment state, each guardrail block, and cost against budget. Because the evidence is a by-product of operating the loop rather than a separate documentation exercise, EU AI Act, ISO/IEC 42001 and NIST AI RMF evidence bundles can be produced on demand from registry state plus gateway logs.