title: “AI Change Management” description: “Manage changes to AI systems, governance conditions, controls, risks, and lifecycle decisions.”
AI Change Management
Change management ensures that material changes to an AI system, its operating environment, or its governance conditions are identified, assessed, approved, implemented, and traceable. Within AIGO, change management connects lifecycle activity with risk management, classification, controls, evidence, assessment, approval, monitoring, assurance, and continual improvement.Purpose
AI systems can change significantly after their initial governance approval. Changes may affect: * system behavior * intended use * deployment context * data * model or system capabilities * risk exposure * control effectiveness * accountable roles * affected stakeholders * regulatory or organizational requirements * evidence requirements * monitoring requirements * assurance requirements Change management determines whether existing governance decisions remain appropriate after a change. The objective is not to prevent change. The objective is to ensure that material change receives appropriate governance treatment before or as it is introduced.When change management applies
Change management should be considered whenever an AI system or its governance environment changes. Potential triggers include: * a change to intended use * a significant model or component update * a change in system capabilities or behavior * a change in data sources or processing * a change in deployment environment * a change in affected stakeholders or populations * a change in system ownership or accountability * a change in classification * a change in risk exposure * a change to applicable requirements * a change to controls * a change to monitoring requirements * a change to assurance requirements * a significant incident * a material finding from monitoring or assurance * a change requested as part of continual improvement Not every technical change requires the same level of governance review. Organizations should establish criteria for determining whether a change is material.Materiality assessment
A change should be evaluated for materiality rather than assumed to be material or immaterial solely because of its technical scope. Materiality may depend on: * the nature of the change * the affected AI system * the intended use * the system’s classification * affected stakeholders * potential impacts * changes in risk * changes in controls * applicable requirements * the organization’s governance policy A minor technical change may require significant governance treatment in one context while a larger technical change may have limited governance consequences in another. The materiality decision should itself be recorded where required by the organization’s governance process.Change management workflow
A practical AIGO change-management workflow is: 1. Identify the change 2. Record the change 3. Determine materiality 4. Assess impact 5. Reassess classification where necessary 6. Reassess risks and risk treatment 7. Review affected controls 8. Determine required evidence 9. Determine whether approval is required 10. Implement the change 11. Verify the implementation 12. Update monitoring and assurance activities 13. Close the change 14. Maintain the resulting governance records The exact workflow may vary according to organizational policy and the characteristics of the AI system.1. Identify the change
The organization should identify what is changing and why. The change description should be sufficiently clear to establish: * what is changing * why it is changing * which AI system is affected * who requested or initiated the change * when the change was identified * the expected implementation date * the expected governance impact2. Determine materiality
The organization should determine whether the change requires formal governance treatment. The materiality decision should consider the AI system’s: * classification * risk profile * intended use * affected stakeholders * controls * applicable requirements * operational context Material changes should proceed through the appropriate governance workflow.3. Assess impact
For material changes, the organization should assess the potential impact of the proposed change. Impact assessment may include: * system functionality * model behavior * data * security * privacy * safety * affected stakeholders * operational processes * controls * monitoring * assurance * legal or regulatory requirements * existing governance decisions The impact assessment should identify which governance records may need to be updated.4. Reassess classification
A material change may alter the appropriate governance classification of an AI system. Potential triggers include changes to: * intended use * capabilities * deployment context * affected stakeholders * risk exposure * applicable requirements Where classification changes, the resulting decision should be recorded and linked to the change that triggered it. See AI System Classification.5. Reassess risks
Changes should be evaluated to determine whether existing risks remain valid and whether new risks have emerged. Risk reassessment may result in: * existing risks remaining unchanged * existing risks being modified * new risks being identified * risk treatment being changed * residual risk being changed * additional controls being required See Risk Assessment.6. Review controls
The organization should determine whether existing controls remain appropriate and effective after the change. This may require: * new controls * modified controls * additional control assessments * additional evidence * revised monitoring * revised assurance activities The relationship should remain traceable: change → risk → control → evidence → assessment See Control Assessment.7. Determine approval requirements
A material change may require governance approval before implementation. Approval requirements should be determined according to: * organizational governance policy * system classification * risk level * change materiality * applicable requirements * affected stakeholders * existing approval conditions Where approval is required, the decision should identify any conditions, restrictions, remediation actions, or monitoring requirements. See AI Governance Approval.8. Implement and verify the change
Once the required governance decisions have been made, the change can be implemented according to the organization’s controlled change process. Implementation should be verified to determine whether: * the intended change was implemented * unauthorized changes were avoided * required controls were implemented * required evidence was produced * approval conditions were satisfied * expected governance outcomes were achieved9. Update monitoring and assurance
A material change may require changes to ongoing monitoring or assurance. Organizations should determine whether: * monitoring metrics need to change * monitoring frequency needs to change * new risks require monitoring * new controls require assessment * assurance scope needs to change * previous assurance conclusions remain valid This maintains governance continuity after implementation.10. Close the change
A change should only be closed when the required governance activities have been completed. The change record should provide sufficient traceability to determine: * what changed * why it changed * who authorized it * what impacts were assessed * which risks were affected * which controls were affected * what evidence was produced * whether implementation was verified * whether monitoring or assurance was updated * whether additional actions remain outstandingTraceability
Significant changes should be traceable to: * the affected AI system * the change record * the change rationale * the materiality decision * the impact assessment * relevant classification decisions * relevant risks * affected controls * supporting evidence * required approvals * implementation actions * monitoring activities * assurance activities * resulting improvement actions This creates a continuous governance history throughout the AI system lifecycle. A representative relationship is: AI system → change → impact → classification → risk → control → evidence → assessment → approval → monitoring → assurance Not every change requires every activity. The applicable pathway should be determined by the materiality and governance context of the change.Machine-readable representation
AIGO provides a machine-readable Change Schema for representing governed changes and their associated information. The Change Schema can be related to other governed records, including: * AI systems * risks * controls * assessments * approvals * monitoring * incidents * assurance * evidence * improvements This allows change management information to participate in the broader AIGO traceability model.Canonical schema
schemas/08-change/08-AIGO-Change-Schema-v0.1.json
Schema documentation
schemas/08-change/08-AIGO-Change-Schema-Documentation-v0.1.md
Relationship to evaluation
Changes may trigger governance reassessment or machine-readable evaluation. Where AIGO governance rules and evaluations are used, a material change can become an input to determine whether: * classification conditions remain satisfied * required controls remain applicable * approval conditions remain satisfied * required evidence exists * monitoring requirements remain appropriate * governance requirements continue to be satisfied The evaluation architecture separates: governance records → evaluation rules → evaluation results Evaluation can therefore support change governance without replacing the underlying governance decision process.Relationship to incidents
Some changes originate from incidents or findings. For example: incident → investigation → change → risk reassessment → control update → approval → monitoring Where an incident results in a material system or governance change, the change should remain traceable to the originating incident. See Incident Management.Relationship to continual improvement
Change management is also an input to continual improvement. Changes can reveal: * weaknesses in existing controls * gaps in governance procedures * emerging risks * inadequate monitoring * insufficient evidence * opportunities to improve governance processes Where appropriate, these findings should feed into the continual improvement process. See Continuous Improvement.Operational artifacts
A practical implementation should maintain appropriate records for governed changes. Typical artifacts include: * change request * change description * materiality assessment * impact assessment * classification reassessment * risk reassessment * control review * evidence * approval decision * implementation record * verification results * monitoring updates * assurance updates * closure decision Organizations may combine these records where appropriate, provided that required traceability is maintained.Implementation resources
The implementation procedure is maintained in:guidance/02-procedures/07-AIGO-AI-Change-Management-Procedure-v0.1.md
The corresponding template is maintained in:
guidance/03-templates/11-AIGO-AI-Change-Management-Template-v0.1.md
The machine-readable structure is:
schemas/08-change/08-AIGO-Change-Schema-v0.1.json