An AI use case can change materially even when its name stays the same. A new model version, different data source, revised prompt, expanded audience, new integration, or changed vendor capability can alter the risks and controls that were accepted during the original review.
Define what counts as a material change
Create triggers that require reassessment. Examples can include changes to model or provider, decision authority, input data, output use, affected population, automation level, retention, external integrations, security controls, or the consequences of an error.
Compare the change with the approved use case
Review what is different, why it changed, which assumptions no longer hold, and whether existing controls still address the relevant risks. Keep the prior approval record so reviewers can see the evolution of the use case rather than evaluating it without history.
Scale review to the impact
A minor wording adjustment may need a lightweight check, while a new model, new sensitive data, or a move from advisory output to automated action may require deeper testing and renewed approval. Define these thresholds before teams are under release pressure.
Retest what the change can affect
Testing should focus on the capabilities, failure modes, security conditions, human-oversight controls, and monitoring signals that could reasonably change. NIST AI RMF resources organize AI risk management across Govern, Map, Measure, and Manage and support lifecycle-oriented risk management.
Record the decision and monitoring plan
Capture the change, evidence reviewed, decision owner, conditions of approval, unresolved issues, and any updated monitoring or stop criteria. A change review should leave an auditable explanation of why continued use was accepted.
Respect professional and regulated boundaries
A governance review does not itself establish that an AI system is lawful, clinically appropriate, financially suitable, fair, accessible, safe, or compliant. Those judgments remain with appropriately qualified and authorized professionals where applicable.
Related knowledge
Use this with AI Vendor Change Review, AI Use-Case Approval Records, AI Monitoring Plans, and AI Human Oversight Design.
References
This resource supports operational governance and does not replace qualified legal, regulatory, clinical, financial, employment, safety, accessibility, privacy, or other professional review.