Skip to main content

​
Changes

Use the Change Management workspace to record, assess, implement, validate, and close changes affecting an AI system. Changes provide a traceable governance record for what is changing, why it is changing, how the change is tested and implemented, and what follow-up governance is required.

​
When to use it

Use this workspace when an AI system or its governance context changes, including changes involving:
  • business requirements;
  • model or technology upgrades;
  • data;
  • security or privacy;
  • suppliers;
  • controls;
  • risk treatment;
  • incidents;
  • monitoring findings;
  • assurance findings;
  • corrective actions;
  • regulatory or strategic requirements.
Changes may require additional risk assessment, review, approval, validation, monitoring, or reassessment.

​
What to enter

​
Change definition

Record:
  • Change Title — concise name for the change.
  • Change Type — category of change.
  • Status — current change lifecycle state.
  • Change Owner — responsible governance role.
  • Change Requestor — role requesting the change.
  • Performed by — person who performed the governance action.
  • Change Description — what is changing.
Change Title and Change Description are required.

​
Change objective and state

Record where applicable:
  • Change Objective — intended outcome.
  • Background — context for the change.
  • Current State — state before the change.
  • Proposed State — intended state after the change.
  • Planned Implementation Date.
  • Actual Implementation Date.
Use the related-record fields to maintain traceability:
  • Risk IDs
  • Control IDs
  • Approval IDs
  • Incident IDs
  • Assurance IDs
These identifiers connect the change to other governance records affected by or contributing to the change.

​
Testing

Use the Testing section to record how the change will be assessed before or during implementation. Record:
  • Testing Objective
  • Test Methods
  • Overall Result
Available test methods include functional, regression, performance, fairness, security, privacy, robustness, resilience, explainability, human oversight, integration, data quality, and rollback testing. Testing results can indicate whether the change passed, passed with conditions, failed, remains in progress, or is inconclusive.

​
Rollback

Use the Rollback section to record whether the change can be reversed safely. Record:
  • Rollback Required
  • Rollback Available
  • Rollback Tested
  • Approved Previous State
  • Procedure Reference
Rollback information is particularly important for changes where implementation failure or unexpected effects could create material governance or operational risk.

​
Emergency Change

Use the Emergency Change section when a change is implemented under emergency conditions. Record:
  • Emergency Change Used
  • Reason
  • Immediate Risk
  • Authority
  • Immediate Controls
  • Retrospective Review Required
  • Retrospective Review Date
Emergency handling should still preserve governance traceability and identify any retrospective review or corrective action required.

​
Change Review

Use the Change Review section to establish ongoing review requirements. Record:
  • Frequency
  • Next Review Date
  • Review Owner
  • Triggered Review Criteria
Review criteria can identify circumstances that should trigger additional governance review.

​
Change History

The Change History section lists previously recorded changes. For each change you can:
  • View Details to inspect the governance record;
  • Edit to update the change;
  • Delete the change when permitted by the organization’s record-management rules.
The details view includes the change overview, description and objective, current and proposed state, implementation dates, testing, rollback, emergency-change information, review information, and related governance records.

​
What the result means

A saved change becomes a governance record associated with the AI system. The record provides traceability between: change → objective → risks → controls → testing → implementation → review → related governance records A change record does not by itself establish legal compliance, certification, accreditation, or conformity assessment. The change may result in additional governance activities such as risk treatment, review, approval, validation, monitoring, reassessment, or assurance.

​
What comes next

After recording a change:
  • assess its governance and risk implications;
  • update affected risks and controls;
  • complete required testing;
  • obtain required review or approval;
  • validate the implemented change where applicable;
  • monitor the changed system;
  • perform reassessment when triggers or governance requirements require it;
  • retain supporting governance evidence.
Material or emergency changes should receive the level of governance attention appropriate to their impact and circumstances.

​
Framework reference

Follow the applicable AIGO Framework guidance for change management, lifecycle governance, risk management, controls, review, approval, validation, monitoring, reassessment, evidence, and assurance.