An AI system can change without a new project launch. Vendors update models, teams modify prompts, integrations gain permissions, data sources change, and a workflow may gradually move from recommendation to action.
Define material change
Set re-review triggers before deployment. Examples include a model or provider change, new sensitive data, expanded permissions, a new affected population, a change in automated authority, material performance drift, or a new legal or contractual context.
Match review depth to the change
A copy edit to user instructions may need a light check. A change that affects decisions, data exposure, autonomy, or reversibility may require renewed testing and approval from business, security, privacy, legal, compliance, or professional owners as appropriate.
Keep evidence
Record what changed, why, who approved it, what was retested, known limitations, and the effective version or date. This makes later incidents and performance reviews easier to reconstruct.
Watch vendor-managed change
Review vendor terms and release practices so the organization knows how material model, subprocessor, retention, security, or product changes are communicated.
Related knowledge
Use this guide with AI Use-Case Records, AI Vendor Due-Diligence, Human Review Models, and AI Risk Classification.
References
This resource supports operational governance. It is not legal or regulatory advice and does not determine whether a changed system is permissible in a regulated use.