DevOps & CI/CD for UK AI — ICO AI guidance 2023 Built In

MLOps — The AI/ML Equivalent of DevOps

AI/ML systems require a specialised DevOps practice called MLOps. Unlike traditional software (where the code is the primary artefact), AI/ML systems have two artefacts: code AND model weights. A trained model is a deployable artefact that must be versioned, tested, and deployed with the same rigour as application code. MLflow (experiment tracking), DVC (data version control), and AWS SageMaker or Azure ML (managed ML platforms) are the standard UK MLOps tools.

Model Drift Detection in CI/CD

AI models degrade in production as the real-world data distribution shifts from training data (model drift). MLOps CI/CD pipelines must include: automated model performance monitoring (accuracy, precision, recall tracked per week), statistical drift detection tests (Population Stability Index, KL divergence), and automated retraining triggers when drift thresholds are exceeded. ICO AI guidance: organisations must monitor AI system performance and have processes for human intervention.

UK GDPR Article 22 in the Deployment Pipeline

AI systems making automated decisions about individuals must: disclose that automated processing is occurring, provide the right to human review, and log decisions for ICO accountability. MLOps CI/CD pipelines should include: automated Article 22 compliance checks (does this model output trigger a deployment decision?), audit log pipeline for all automated decisions, and automated alerts for decision confidence below threshold (routing to human review).

AI Model Security in CI/CD

AI models are a new attack surface. Adversarial inputs can cause misclassification. Model inversion attacks can reconstruct training data. Data poisoning during training can compromise the model. MLOps CI/CD should include: adversarial robustness testing in the pipeline, model card generation (documenting training data, limitations, and appropriate use), and dependency scanning for ML framework vulnerabilities (PyTorch, TensorFlow CVEs are tracked by Dependabot).

ICO AI guidance 2023

UK GDPR Article 22

Cyber Essentials

model drift monitoring