AI lifecycle governance platform device and management Method thereof

Abstract

An AI lifecycle governance platform device and a management method are disclosed. The AI ​​lifecycle governance platform device comprises: a technical verification management module that analyzes security vulnerabilities of an AI model based on attack scenarios, evaluates security functions by performing security tests and penetration tests on the AI ​​model, and checks whether each component of the AI ​​model complies with country- and industry-specific compliance requirements by utilizing an AI governance library; a data lifecycle management module that analyzes whether legal and ethical requirements are met according to the data lifecycle of the AI ​​model, verifies the legal validity of contracts, consent forms, and data sharing agreements derived from the data lifecycle of the AI ​​model, and verifies compliance with protection measures for data collected, stored, transmitted, and processed in the data lifecycle; and a compliance and organization management module that monitors internal governance compliance in real time by generating and providing checklists and survey information to check compliance required for each country and industry sector where the AI ​​model is installed and operated. It includes an external environment management module that checks the security status of the physical and network environments in which the AI ​​model operates in real time, and monitors defects in the AI ​​model in real time by analyzing the operating status, security logs, and anomaly detection events of the AI ​​model.

Description

Technology Field

[0001] The present invention relates to an AI lifecycle governance platform device and a management method. Background Technology

[0003] Although the AI ​​market has recently grown rapidly with active investment and utilization, the frequent occurrence of personal information leakage incidents caused by AI has led to a gradual increase in AI-related regulations both domestically and internationally, including personal information protection laws, guidelines, the EU AI ACT, and GDPR. However, such markets are very small compared to the AI ​​market, and outsourcing through consulting firms is costly.

[0004] Conventional technology verifies personal information protection by focusing on the data collection and preprocessing stages within the AI ​​lifecycle. Furthermore, since defense strategies against attacks on AI are primarily related to the rhetoric of AI models, such as adversarial attacks, privacy protection is verified by concentrating on these processes. However, there is a problem in that conventional technology makes it difficult to verify the level of data anonymity and defense strategies against personal information infringement attacks on AI models during the AI ​​development and deployment process. The problem to be solved

[0006] The present invention is intended to provide a privacy-based AI lifecycle governance platform device and a management method.

[0007] Furthermore, the present invention aims to provide a privacy-based AI lifecycle governance platform device and management method capable of verification throughout the entire AI lifecycle by considering both privacy and the reliability of AI models to comply with compliance requirements that differ by country and industry. Additionally, the present invention aims to provide a privacy-based AI lifecycle governance platform device and management method capable of reviewing the legality of the data lifecycle for each stage of the AI ​​lifecycle, inspecting contracts derived from each stage, and verifying physical and administrative protection measures for data. means of solving the problem

[0009] According to one aspect of the present invention, an AI lifecycle governance platform device is provided.

[0010] According to one embodiment of the present invention, a technical verification management module that analyzes security vulnerabilities of an AI model based on attack scenarios, evaluates security functions by performing security tests and penetration tests on the AI ​​model, and checks whether each component of the AI ​​model complies with country- and industry-specific compliance requirements by utilizing an AI governance library; a data lifecycle management module that analyzes whether legal and ethical requirements are met according to the data lifecycle of the AI ​​model, verifies the legal validity of contracts, consent forms, and data sharing agreements derived from the data lifecycle of the AI ​​model, and verifies compliance with protection measures for data collected, stored, transmitted, and processed in the data lifecycle; and a compliance and organization management module that monitors internal governance compliance in real time by generating and providing checklists and survey information to check compliance required for each country and industry sector where the AI ​​model is installed and operated. An AI lifecycle governance platform device may be provided, comprising an external environment management module that checks the security status of the physical and network environments in which the AI ​​model is operated in real time, and analyzes the operational status, security logs, and anomaly detection events of the AI ​​model to monitor defects of the AI ​​model in real time.

[0011] The above attack scenarios may include a privacy infringement scenario including at least one of a membership inference attack, a model breach attack, and a re-identification attack; an AI model itself attack scenario including at least one of a model extraction attack, a model reverse engineering attack, and a model stealing attack; and a data integrity-manipulation related attack scenario including at least one of a data poisoning attack and an adversarial sample attack.

[0012] The above technical verification management module verifies the privacy protection and security functions of the AI ​​model throughout the entire process from development to decommissioning by applying AI governance by AI lifecycle, and may also verify the privacy protection and security functions of the AI ​​model by applying different verification methods to each process of the AI ​​lifecycle.

[0013] The technical verification management module may analyze the success rate of the attack scenario to score the security vulnerability, measure the level of application of privacy protection measures of the AI ​​model to calculate the protection score, and evaluate the risk level of the AI ​​model based on the calculated security vulnerability and the privacy protection score.

[0014] The above data lifecycle management module detects data that the AI ​​model no longer uses, discards the detected data according to data disposal and expiration policies, and can verify whether the discarded data is unrecoverable.

[0015] The compliance and organization management module visualizes and outputs the compliance status regarding country-industry compliance corresponding to the AI ​​model through a dashboard that monitors the status in real time, and can further monitor whether legal certification conditions are met according to the regulatory agency requirements of the AI ​​model.

[0016] The technical verification management module described above can automatically record the change history whenever the AI ​​model is updated and further check whether the change meets security and compliance requirements.

[0017] When a third-party dataset is utilized in the AI ​​model, the above data lifecycle management module may perform an integrity check on whether there is any tampering on the website of the third-party dataset, review whether there are any restrictions on the training of the AI ​​model by checking the license and terms of use of the third-party dataset, and analyze whether personal information is included in the third-party dataset and whether personal information is pseudonymized and anonymized.

[0019] According to another aspect of the present invention, an AI lifecycle governance management method may be provided.

[0020] According to one embodiment of the present invention, a method for managing AI lifecycle governance comprises: (a) a step of analyzing whether legal and ethical requirements are met according to the data lifecycle of an AI model, verifying the legal validity of contracts, consent forms, and data sharing agreements derived from the data lifecycle of the AI ​​model, and verifying whether protection measures for data collected, stored, transmitted, and processed in the data lifecycle are complied with; (b) a step of analyzing security vulnerabilities of the AI ​​model based on attack scenarios, evaluating security functions by performing security tests and penetration tests on the AI ​​model, and checking whether each component of the AI ​​model complies with country- and industry-specific compliance requirements by utilizing an AI governance library; and (c) a step of monitoring internal governance compliance in real time by generating and providing checklists and survey information that check compliance required for each country- and industry sector where the AI ​​model is installed and operated. and (d) a step of checking the security status of the physical and network environment in which the AI ​​model is operated in real time, and analyzing the operating status of the AI ​​model, security logs, and anomaly detection events to monitor defects of the AI ​​model in real time, wherein at least a plurality of steps (a) to (d) may be performed in parallel. Effects of the invention

[0022] By providing a privacy-based AI lifecycle governance platform device and management method according to an embodiment of the present invention, there is an advantage in that verification is possible throughout the entire AI lifecycle by considering both privacy and the reliability of AI models to comply with compliance requirements that differ by country and industry.

[0023] In addition, the present invention has the advantage of enabling the evaluation of an organization's AI governance at a low cost and allowing the organization to directly participate in the verification process, thereby ensuring a transparent and secure protocol.

[0024] In addition, the present invention may review the legality of the data lifecycle according to the AI ​​lifecycle, inspect contracts derived from each process, and verify physical / administrative protection measures for the data. Brief explanation of the drawing

[0026] FIG. 1 is a schematic diagram illustrating the internal configuration of an AI lifecycle governance platform device according to one embodiment of the present invention. Figure 2 is a diagram illustrating the AI ​​lifecycle. FIG. 3 is a flowchart illustrating an AI lifecycle governance management method according to an embodiment of the present invention. FIG. 4 is a diagram illustrating the entire workflow according to the AI ​​lifecycle according to an embodiment of the present invention. Specific details for implementing the invention

[0027] As used in this specification, singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, terms such as "composed" or "comprising" should not be interpreted as necessarily including all of the various components or steps described in the specification, and should be interpreted as meaning that some of the components or steps may be excluded, or that additional components or steps may be included. Furthermore, terms such as "...part," "module," etc., as used in the specification refer to a unit that processes at least one function or operation, which may be implemented in hardware or software, or a combination of hardware and software.

[0028] Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings.

[0030] FIG. 1 is a schematic diagram illustrating the internal configuration of an AI lifecycle governance platform device according to one embodiment of the present invention.

[0031] Referring to FIG. 1, an AI lifecycle governance platform device (100) according to one embodiment of the present invention is configured to include a technical verification management module (110), a data lifecycle management module (120), a compliance and organization management module (130), an external environment management module (140), a memory (150), and a processor (160).

[0032] The technical verification management module (110) inspects, verifies, and reviews the security, reliability, and ethics of the AI ​​model or AI system. That is, the technical verification management module (110) can analyze security vulnerabilities of the AI ​​model based on attack scenarios, evaluate security functions by performing security tests and penetration tests on the AI ​​model, and check whether each component of the AI ​​model complies with country-industry compliance requirements by utilizing an AI governance library.

[0033] These technical verification management modules (110) may include, in detail, an AI privacy and security inspection module, an AI governance compliance evaluation module, and a reliability review module.

[0034] The AI ​​privacy and security inspection module can verify how AI models or AI systems use personal information, and whether data is de-identified (anonymized) or encrypted.

[0035] The AI ​​privacy and security inspection module can verify the security functions of an AI model or AI system by simulating attacks on the AI ​​model or / or AI system based on personal information infringement scenarios. Here, the personal information infringement scenarios may be membership inference attacks, model compromise attacks, and re-identification attacks.

[0036] The AI ​​privacy and security inspection module can further simulate attack scenarios, such as model extraction attacks, model reverse engineering attacks, and model stealing attacks, to evaluate not only personal information infringement scenarios but also the integrity and confidentiality of AI models.

[0037] The AI ​​governance compliance assessment module can verify whether AI models provide biased results, whether they deviate from the governance of the applicable industries and countries, and compliance with international standards or guidelines (e.g., GDPR, AI Act).

[0038] In addition, the AI ​​governance compliance evaluation module verifies the privacy protection and security functions of the AI ​​model throughout the entire process from development to decommissioning by applying AI governance by AI lifecycle, and can verify the privacy protection and security functions of the AI ​​model by applying different verification methods to each process of the AI ​​lifecycle.

[0039] For example, the AI ​​governance compliance evaluation module can check whether the training data of an AI model is biased or contains imbalanced data regarding specific groups (e.g., gender, race, age, etc.). Additionally, the module can determine the presence of bias by analyzing the results generated by the AI ​​model to identify discriminatory predictions regarding specific groups. For instance, if an AI model reacts differently to women and men or makes negative predictions regarding a specific race, the module can determine that the AI ​​model is biased.

[0040] In addition, the AI ​​governance compliance evaluation module can use fairness indicators such as Demographic Parity and Equalized Odds to check whether the model's results are fair to a specific group, and can also verify counterfactual fairness by confirming that the AI ​​model's predictions do not change when specific characteristics (e.g., race, gender, etc.) are altered while obtaining the same results.

[0041] In addition, the AI ​​governance compliance assessment module can verify whether AI models comply with relevant regulations and legal standards (e.g., GDPR, AI Act). For instance, it can assess compliance with GDPR regulations by examining the data processing methods of AI models, verify data de-identification—such as whether the data used by the AI ​​models is anonymized or uses only the minimum amount of personal information—and inspect and evaluate whether the storage and transmission of personal information are securely encrypted and comply with international data transfer regulations.

[0042] In other words, the AI ​​governance compliance evaluation module can evaluate and verify whether AI models or / and AI systems comply with regulatory and legal standards based on the AI ​​governance library.

[0043] The reliability review module can verify the reliability of the AI ​​model through fairness and non-discrimination tests. For example, the reliability review module may score security vulnerabilities by analyzing the success rate of attack scenarios, calculate a protection score by measuring the level of application of privacy protection measures in the AI ​​model, and evaluate the risk level of the AI ​​model based on the calculated security vulnerabilities and the privacy protection score.

[0044] Depending on the implementation method, the reliability review module can review and verify whether the results of an AI model or / or AI system are explainable and transparent (e.g., XAI, model interpretability), and can also review fairness and non-discrimination.

[0045] For example, a reliability review model can test fairness using fairness indicators to examine whether decisions made by an AI model work against specific groups or individuals. Here, fairness indicators such as Demographic Parity, Equalized Odds, and Equal Opportunity may be used.

[0046] In addition, reliability review models can use indicators such as Fairness Indicators and the AI ​​Fairness 360 Toolkit to review / test whether the AI ​​model acts discriminatorily toward specific groups.

[0047] As illustrated in FIG. 2, the technical verification management module (110) can perform various verification processes throughout the entire lifecycle of the AI ​​model (e.g., planning, data collection, preprocessing, development, and deployment). Additionally, the technical verification management module (110) can automatically record the change history whenever the AI ​​model is updated and further check whether the change meets security and compliance requirements.

[0048] The data lifecycle management module (120) can analyze whether legal and ethical requirements are met according to the data lifecycle of the AI ​​model, verify the legal validity of contracts, consent forms, and data sharing agreements derived from the data lifecycle of the AI ​​model, and verify whether protection measures for data collected, stored, transmitted, and processed in the data lifecycle are complied with.

[0049] For example, the data lifecycle management module (120) may verify the legality of the data collection process, verify the legality of the data use / provision process, and verify the legality of the data destruction process and other administrative measures process.

[0050] That is, the data lifecycle management module (120) can verify the purpose for which the AI ​​model is developed during the data collection process, whether the personal information processing policy has been written as an official document, and confirm the legitimacy of said document. In addition, the data lifecycle management module (120) can encourage the creation of a data collection plan to record the source and process of data collection. The plan may include contents such as the purpose of data collection, data items to be collected, data collection methods, data storage locations and security measures, and data disposal plans, and the data lifecycle management module (120) can verify the legitimacy of each item by checking whether each item is included in the document.

[0051] In addition, the data lifecycle management module (120) may verify the legitimacy of each item by checking whether optional and mandatory items are separated and whether each item is included in the consent form, when the purpose of data collection, items of data collection, data retention period, scope of data use, whether to provide to a third party, method of withdrawing consent, etc., must be included in the data collection consent form.

[0052] The data lifecycle management module (120) can also verify whether there are essential items that must be included in the consent form by checking through an NLP-based contract analysis program.

[0053] In addition, during the process of data use and provision, the data lifecycle management module (120) can verify whether pseudonymization or anonymization has been performed. That is, the level of anonymization / pseudonymization can be automatically tested through internal data and attack scenarios. In addition, the data lifecycle management module (120) can verify the quality of the data itself (verification of data bias and source) and verify security during the data storage stage.

[0054] In addition, the data lifecycle management module (120) detects data that the AI ​​model no longer uses, and discards the detected data according to the data disposal and expiration policy, and may also verify whether the discarded data is unrecoverable.

[0055] Additionally, when a third-party dataset is used in an AI model, the data lifecycle management module (120) may perform an integrity check on whether there is any tampering on the website of the third-party dataset, check the license and terms of use of the third-party dataset to examine whether there are any restrictions on the training of the AI ​​model, and analyze whether personal information is included in the third-party dataset and whether personal information is pseudonymized and anonymized.

[0056] Additionally, the data lifecycle management module (120) may manage access rights so that only pre-authorized personnel can access the data, verify whether the data is encrypted when stored and transmitted, and check whether data access and changes are logged.

[0057] Additionally, the data lifecycle management module (120) may check / verify the Data Sharing Agreement (DSA) to see whether the purpose of data provision and usage restrictions are specified, and whether it includes data security measures and liability provisions. The data lifecycle management module (120) may also automatically analyze the purpose of data sharing, security clauses, whether it is provided to a third party, and liability in the event of legal issues through NLP (natural language processing)-based contract analysis, and an AI model inside the platform device may identify items that must be included, check for regulatory compliance, and output a recommendation message to modify them.

[0058] In addition, the data lifecycle management module (120) may check whether the data subject consents when providing personal data, and may provide the results of a legal review to determine whether the data can be provided to a third party without prior consent.

[0059] In addition, the data lifecycle management module (120) may analyze compliance based on data by data source and display and provide the compliance status for each stage of the AI ​​lifecycle. Here, the data by data source may be data collected within the company's network, data collected outside the company's network, or data directly entered by the person in charge.

[0060] The compliance and organization management module (130) may also monitor internal governance compliance in real time by generating and providing checklists and survey information that check compliance required for each country-industry sector where the AI ​​model is installed and operated.

[0061] Additionally, the compliance and organization management module (130) visualizes and outputs the status of compliance with country-industry compliance corresponding to the AI ​​model through a dashboard that monitors the status in real time, and may further monitor whether the AI ​​model meets legal certification conditions according to regulatory agency requirements.

[0062] The external environment management module (140) can check the security status of the physical and network environment in which the AI ​​model is operated in real time, and analyze the operating status of the AI ​​model, security logs, and anomaly detection events to monitor defects in the AI ​​model in real time.

[0063] The memory (150) stores various instructions for performing an AI lifecycle governance management method according to one embodiment of the present invention.

[0064] A processor (160) is a means for controlling internal components (e.g., a technical verification management module (110), a data lifecycle management module (120), a compliance and organization management module (130), an external environment management module (140), a memory (150), etc.) of an AI lifecycle governance platform device (100) according to one embodiment of the present invention.

[0066] FIG. 3 is a flowchart illustrating an AI lifecycle governance management method according to an embodiment of the present invention.

[0067] In step 310, the AI ​​lifecycle governance platform device (100) can analyze whether legal and ethical requirements are met according to the data lifecycle of the AI ​​model, verify the legal validity of contracts, consents, and data sharing agreements derived from the data lifecycle of the AI ​​model, and verify whether protection measures for data collected, stored, transmitted, and processed in the data lifecycle are complied with.

[0068] For example, Figure 4 illustrates a workflow according to the AI ​​lifecycle. That is, during the data collection, use, and preprocessing processes of the AI ​​lifecycle, it is possible to verify whether personal information among the training data used for the AI ​​model has been appropriately anonymized, whether the anonymized data has been processed so that individuals cannot be identified, whether the anonymized data is used for its intended purpose, and whether privacy protection technologies such as differential privacy, synthetic data, and homomorphic encryption are being utilized.

[0069] In step 315, the AI ​​lifecycle governance platform device (100) analyzes security vulnerabilities in the AI ​​model based on attack scenarios, evaluates security functions by performing security tests and penetration tests on the AI ​​model, and checks whether each component of the AI ​​model complies with country-industry compliance requirements by utilizing the AI ​​governance library.

[0070] For example, during the AI ​​model development and verification process in the AI ​​lifecycle of Fig. 4, it is possible to verify whether there is defense against attacks attempting to infer sensitive information from the AI ​​model through various intrusion scenarios and attack scenarios, and whether there is defense against attacks involving abnormal behavior of the AI.

[0071] For example, it may be tested whether measures have been established against the leakage of sensitive / personal information from AI models, whether the characteristics of membership inference attacks, model inversion attacks, and model theft attacks are recognized, whether risk assessments have been performed by measuring risk through pre-tests for each attack type, whether protection technologies such as differential privacy have been introduced as defense techniques against each attack, and whether tests have been performed on reduced attack performance through privacy protection technologies such as differential privacy technology.

[0072] In addition, it can be verified whether defensive technologies have been introduced based on the detection of abnormal behavioral attacks in AI models, whether risk assessments have been performed through risk measurements based on pre-tests for each attack type such as AI supply chain attacks, data poisoning attacks, model poisoning attacks, and model asymmetry, whether protection technologies have been introduced for each attack type, and whether tests have been performed on reduced attack performance after the application of protection technologies.

[0073] In step 320, the AI ​​lifecycle governance platform device (100) monitors internal governance compliance in real time by generating and providing checklists and survey information that check compliance required for each country-industry sector where the AI ​​model is installed and operated.

[0074] In step 325, the AI ​​lifecycle governance platform device (100) checks the security status of the physical and network environment in which the AI ​​model is operated in real time, and analyzes the operating status of the AI ​​model, security logs, and anomaly detection events to monitor defects in the AI ​​model in real time.

[0075] Steps 310 through 325 can be performed in parallel according to the AI ​​lifecycle.

[0077] An apparatus and method according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., either alone or in combination. The program instructions recorded on the computer-readable medium may be those specifically designed and configured for the present invention, or they may be those known and available to a person skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical recording media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, and flash memory. Examples of program instructions include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

[0078] The hardware device described above may be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

[0079] The present invention has been described above with reference to its embodiments. Those skilled in the art will understand that the present invention may be implemented in modified forms without departing from the essential characteristics of the invention. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the invention is defined by the claims, not by the foregoing description, and all variations within the scope of the claims should be interpreted as being included in the invention.

Claims

Claim 1 An AI lifecycle governance platform device comprising: a technical verification management module that analyzes security vulnerabilities of an AI model based on attack scenarios, evaluates security functions by performing security tests and penetration tests on the AI ​​model, and checks whether each component of the AI ​​model complies with country- and industry-specific compliance requirements by utilizing an AI governance library; a data lifecycle management module that analyzes whether legal and ethical requirements are met according to the data lifecycle of the AI ​​model, verifies the legal validity of contracts, consent forms, and data sharing agreements derived from the data lifecycle of the AI ​​model, and verifies compliance with protection measures for data collected, stored, transmitted, and processed in the data lifecycle; a compliance and organization management module that monitors internal governance compliance in real time by generating and providing checklists and survey information to check compliance required for each country- and industry sector where the AI ​​model is installed and operated; and an external environment management module that checks the security status of the physical and network environment where the AI ​​model operates in real time, and monitors defects of the AI ​​model in real time by analyzing the operational status, security logs, and anomaly detection events of the AI ​​model. Claim 2 An AI lifecycle governance platform device according to claim 1, characterized in that the attack scenarios include a personal information infringement scenario comprising at least one of a membership inference attack, a model breach attack, and a re-identification attack; an AI model itself attack scenario comprising at least one of a model extraction attack, a model reverse engineering attack, and a model stealing attack; and a data integrity-manipulation related attack scenario comprising at least one of a data poisoning attack and an adversarial sample attack. Claim 3 An AI lifecycle governance platform device according to claim 1, wherein the technical verification management module verifies the privacy protection and security functions of the AI ​​model throughout the entire process from development to disposal by applying AI governance by AI lifecycle, and verifies the privacy protection and security functions of the AI ​​model by applying different verification methods to each process of the AI ​​lifecycle. Claim 4 An AI lifecycle governance platform device according to claim 1, wherein the technical verification management module analyzes the success rate of the attack scenario to score the security vulnerability, measures the level of application of privacy protection measures of the AI ​​model to calculate the protection score, and evaluates the risk level of the AI ​​model based on the calculated security vulnerability and the privacy protection score. Claim 5 An AI lifecycle governance platform device according to claim 1, wherein the data lifecycle management module detects data that the AI ​​model no longer uses, discards the detected data according to a data disposal and expiration policy, and verifies whether the discarded data is unrecoverable. Claim 6 An AI lifecycle governance platform device according to claim 1, wherein the compliance and organization management module visualizes and outputs the compliance status regarding country-industry compliance corresponding to the AI ​​model through a dashboard that monitors the status in real time, and further monitors whether the legal certification conditions according to the regulatory agency requirements of the AI ​​model are met. Claim 7 An AI lifecycle governance platform device according to claim 1, wherein the technical verification management module automatically records a change history whenever the AI ​​model is updated and further checks whether the change satisfies security and compliance requirements. Claim 8 An AI lifecycle governance platform device according to claim 1, wherein the data lifecycle management module performs an integrity check regarding whether there is tampering on the website of the third-party dataset when the AI ​​model utilizes the third-party dataset, checks the license and terms of use of the third-party dataset to examine whether there are restrictions on the training of the AI ​​model, and analyzes whether personal information is included in the third-party dataset and whether the personal information has been pseudonymized and anonymized. Claim 9 A method for managing AI lifecycle governance comprises: (a) a step of analyzing whether legal and ethical requirements are met according to the data lifecycle of an AI model, verifying the legal validity of contracts, consent forms, and data sharing agreements derived from the data lifecycle of the AI ​​model, and verifying compliance with protection measures for data collected, stored, transmitted, and processed in the data lifecycle; (b) a step of analyzing security vulnerabilities of the AI ​​model based on attack scenarios, evaluating security functions by performing security tests and penetration tests on the AI ​​model, and checking whether each component of the AI ​​model complies with country- and industry-specific compliance requirements by utilizing an AI governance library; and (c) a step of monitoring internal governance compliance in real time by generating and providing checklists and survey information to check compliance required for each country and industry sector where the AI ​​model is installed and operated. A method for managing AI lifecycle governance, comprising the steps of: (d) checking the security status of the physical and network environment in which the AI ​​model is operated in real time, and analyzing the operational status, security logs, and anomaly detection events of the AI ​​model to monitor defects in the AI ​​model in real time, wherein at least a plurality of steps (a) through (d) are performed in parallel. Claim 10 A method for managing AI lifecycle governance according to claim 9, wherein the attack scenarios include a privacy infringement scenario comprising at least one of a membership inference attack, a model infringement attack, and a re-identification attack; an AI model itself attack scenario comprising at least one of a model extraction attack, a model reverse engineering attack, and a model stealing attack; and a data integrity-manipulation related attack scenario comprising at least one of a data poisoning attack and an adversarial sample attack. Claim 11 In claim 9, the above step (b) is characterized by verifying the privacy protection and security functions of the AI ​​model throughout the entire process from development to disposal by applying AI governance by AI lifecycle, and verifying the privacy protection and security functions of the AI ​​model by applying different verification methods to each process of the AI ​​lifecycle. Claim 12 In claim 9, the above step (b) is characterized by analyzing the success rate of the attack scenario to score the security vulnerability, measuring the level of application of privacy protection measures of the AI ​​model to calculate the protection score, and evaluating the risk level of the AI ​​model based on the calculated security vulnerability and the privacy protection score. Claim 13 A method for managing AI lifecycle governance according to claim 9, wherein step (a) is characterized by detecting data that the AI ​​model no longer uses, discarding the detected data according to a data disposal and expiration policy, and verifying whether the discarded data is unrecoverable. Claim 14 A method for managing AI lifecycle governance according to claim 9, wherein step (c) visualizes and outputs the status of compliance with country-industry compliance corresponding to the AI ​​model in real time through a dashboard that monitors the status of compliance, and further monitors whether the AI ​​model meets legal certification conditions according to regulatory agency requirements. Claim 15 A method for managing AI lifecycle governance according to claim 9, wherein step (b) is characterized by automatically recording a change history whenever the AI ​​model is updated and further checking whether the change satisfies security and compliance requirements. Claim 16 In claim 9, the above step (a) is characterized by performing an integrity check on whether there is any tampering on the website of the third-party dataset when the AI ​​model utilizes the third-party dataset, checking the license and terms of use of the third-party dataset to examine whether there are any restrictions on the training of the AI ​​model, and analyzing whether personal information is included in the third-party dataset and whether the personal information is pseudonymized and anonymized. Claim 17 A computer-readable recording medium for performing a method according to any one of claims 9 through 16.

Images