AIGO — AI Governance Operating Framework
AI Change Management Template
Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-TPL-011
Document Type: AI Change Management Template
Template Purpose: Controlled Identification, Assessment, Approval, Implementation, Validation, and Closure of AI Changes
1. Template Purpose
This template provides the controlled structure for governing changes to an AI system, AI component, AI-related data pipeline, AI control, AI process, or supporting service throughout the AIGO lifecycle. AI changes should be assessed for their potential effect on:- intended purpose;
- users;
- affected persons;
- classification;
- risk;
- controls;
- model behavior;
- data;
- security;
- privacy;
- fairness;
- human oversight;
- monitoring;
- operational performance;
- regulatory obligations;
- third-party dependencies;
- approval status.
- change request;
- AI system;
- lifecycle stage;
- change classification;
- impact assessment;
- risk assessment;
- control assessment;
- testing;
- evidence;
- approval;
- deployment;
- monitoring;
- rollback;
- validation;
- closure;
- continual improvement.
2. Change Management Instructions
Complete all applicable sections. Where information is not available, record: Pending — [reason] Where a field does not apply, record: Not Applicable — [reason] Material changes should not be implemented outside the applicable approved change-management process except where an authorized emergency process applies. Recommended identifiers include:- AI System ID;
- Change ID;
- Risk ID;
- Control ID;
- Test ID;
- Evidence ID;
- Approval ID;
- Deployment ID;
- Monitoring ID;
- Incident ID;
- Assurance ID;
- Improvement ID.
3. Change Record
3.1 Identification
AI System ID: Change ID: Change Version: System Name: System Version Before Change: System Version After Change: Change Title: Change Owner: Change Requestor: System Owner: Business Owner: Technical Owner: Risk Owner: Date Requested: Target Implementation Date:3.2 Change Status
Current Status:- Draft
- Submitted
- Under Assessment
- Approved
- Approved with Conditions
- Scheduled
- In Implementation
- Deployed
- Under Enhanced Monitoring
- Validated
- Closed
- Rejected
- Deferred
- Suspended
- Rolled Back
- Cancelled
4. Change Objective and Background
4.1 Business Objective
Why is the change required?4.2 Change Objective
What should the change achieve?4.3 Background
Relevant Background:4.4 Trigger
Select applicable trigger:- Business Requirement
- Performance Improvement
- Risk Treatment
- Incident
- Security Requirement
- Privacy Requirement
- Regulatory Change
- Technology Upgrade
- Model Upgrade
- Data Change
- Supplier Change
- Control Improvement
- Monitoring Finding
- Assurance Finding
- Corrective Action
- Other
5. Change Description
5.1 Current State
Description of the current state:5.2 Proposed State
Description of the proposed state:5.3 Detailed Change
Describe exactly what will change:5.4 Components Affected
Select applicable:- Model
- Model Version
- Training Data
- Inference Data
- Data Pipeline
- Feature Engineering
- Prompt / Configuration
- Application
- Infrastructure
- API / Integration
- User Interface
- Human Oversight
- Workflow
- Control
- Monitoring
- Security
- Privacy
- Supplier
- Business Process
- Intended Purpose
- Other
6. Change Classification
6.1 Change Classification
Select applicable classification:- Minor
- Standard
- Significant
- Material
- Emergency
6.2 Classification Criteria
The assessment should consider whether the change affects:- intended purpose;
- affected persons;
- decision significance;
- automation;
- model behavior;
- model version;
- data;
- data sensitivity;
- system architecture;
- security;
- privacy;
- fairness;
- safety;
- human oversight;
- risk;
- controls;
- monitoring;
- suppliers;
- regulatory obligations.
6.3 Classification Rationale
Rationale:7. Change Scope
7.1 Organizational Scope
Business Units / Functions Affected:7.2 Geographic Scope
Countries / Regions / Jurisdictions Affected:7.3 User Scope
User Groups Affected:7.4 Affected-Person Scope
Affected Persons / Groups:7.5 Environment Scope
Affected Environments:- Development
- Test
- Staging
- Production
- Restricted Production
- Other
7.6 Exclusions
Areas Not Affected:8. Intended-Purpose Assessment
8.1 Purpose Change
Does the change modify the intended purpose?- Yes
- No
8.2 Intended Use Change
Does the change modify intended use?- Yes
- No
8.3 Restricted / Prohibited Use
Does the change affect restricted or prohibited uses?- Yes
- No
8.4 Governance Consequence
Governance consequence of purpose / use change:9. AI Classification Impact
9.1 Current Classification
Current AIGO Classification:9.2 Classification Impact
Could the change affect classification?- No
- Yes
- Reassessment Required
9.3 Classification Assessment
Classification Assessment ID: Assessment Result:9.4 Reclassification Decision
Decision:- Classification Unchanged
- Classification Increased
- Classification Decreased
- Reassessment Pending
10. Stakeholder and Affected-Person Impact
10.1 Stakeholders
10.2 Affected Persons
Affected-Person Impact:10.3 Potential Harm
Potential New or Changed Harm:10.4 Stakeholder Engagement
Required Engagement: Evidence IDs:11. Business Impact Assessment
11.1 Business Impact
Assess impact on:- operations;
- customers;
- employees;
- services;
- financial performance;
- business continuity;
- contractual commitments;
- reputation.
11.2 Business Criticality
Impact Level:- Low
- Medium
- High
- Critical
12. Technical Impact Assessment
12.1 Architecture Impact
Architecture Changes:12.2 Model Impact
Model Changes:12.3 Integration Impact
Integration Changes:12.4 Infrastructure Impact
Infrastructure Changes:12.5 Dependency Impact
Dependency Changes:12.6 Technical Impact Rating
Impact:- Low
- Medium
- High
- Critical
13. Data Impact Assessment
13.1 Data Changes
Does the change affect:- data sources;
- data types;
- data volume;
- data sensitivity;
- data pipelines;
- data transformations;
- data retention;
- data access;
- data quality.
13.2 Data Sensitivity
Data Sensitivity Impact:- None
- Low
- Medium
- High
- Critical
13.3 Data Quality Impact
Data Quality Impact:13.4 Data Governance Review
Data Governance Assessment ID: Result:14. Model Impact Assessment
14.1 Model Version
Current Model: New Model:14.2 Model Architecture
Architecture Change:14.3 Model Behavior
Expected Behavioral Change:14.4 Model Performance
Expected Performance Change:14.5 Model Risk
Potential New or Changed Model Risks:15. Security Impact Assessment
15.1 Security Impact
Security Impact:- None
- Low
- Medium
- High
- Critical
15.2 Security Changes
Security Changes:15.3 Security Assessment
Security Assessment ID: Result:16. Privacy Impact Assessment
16.1 Privacy Impact
Privacy Impact:- None
- Low
- Medium
- High
- Critical
16.2 Privacy Changes
Privacy Changes:16.3 Privacy Assessment
Privacy Assessment ID: Result:17. Fairness and Impact Assessment
17.1 Fairness Impact
Fairness Impact:- None
- Low
- Medium
- High
- Critical
17.2 Affected Groups
Affected Groups:17.3 Fairness Testing Required
Required:- Yes
- No
- Pending
17.4 Impact Assessment Reference
Assessment ID:18. Human Oversight Impact
18.1 Oversight Impact
Does the change affect human oversight?- No
- Yes
- Reassessment Required
18.2 Oversight Changes
Description:18.3 Human Authority
Does the change alter who may challenge, override, approve, or reject AI outputs?18.4 Oversight Testing
Testing Required:19. Risk Assessment
19.1 Risk Assessment Reference
Risk Assessment ID: Assessment Date: Risk Owner:19.2 New or Changed Risks
19.3 Risk Summary
Overall Pre-Change Risk: Overall Post-Change Risk:19.4 Risk Treatment
Required Treatment:20. Control Impact Assessment
20.1 Controls Affected
20.2 New Controls
New Controls Required:20.3 Modified Controls
Modified Controls:20.4 Retired Controls
Controls Proposed for Retirement:20.5 Control Assessment Reference
Control Assessment ID:21. Monitoring Impact
21.1 Monitoring Impact
Does the change affect monitoring?- No
- Yes
- Reassessment Required
21.2 New Indicators
New Monitoring Indicators:21.3 Changed Thresholds
Changed Thresholds:21.4 Enhanced Monitoring
Enhanced Monitoring Required:- Yes
- No
22. Incident and Historical Findings Review
22.1 Related Incidents
22.2 Related Assurance Findings
22.3 Lessons Learned
Relevant Lessons Learned:23. Third-Party and Supplier Impact
23.1 Supplier Changes
Supplier Change:23.2 Supplier Impact
Impact:23.3 Supplier Notification
Supplier Notification Required:23.4 Supplier Assessment
Supplier Assessment ID: Result:24. Testing and Validation Plan
24.1 Testing Objective
Objective:24.2 Required Testing
Applicable testing may include:- functional;
- regression;
- performance;
- fairness;
- security;
- privacy;
- robustness;
- resilience;
- explainability;
- human oversight;
- integration;
- data quality;
- rollback.
24.3 Test Plan
Test Plan ID: Test Owner: Test Environment:24.4 Test Data
Test Data / Dataset Reference:24.5 Test Exit Criteria
Exit Criteria:25. Test Results
25.1 Test Conclusion
Overall Conclusion:25.2 Outstanding Tests
Outstanding Testing:26. Rollback Planning
26.1 Rollback Required
Rollback Capability Required:- Yes
- No
- Not Applicable
26.2 Rollback State
Approved Previous State / Version:26.3 Rollback Procedure
Rollback Procedure Reference:26.4 Rollback Conditions
Rollback may be required when:- material performance degradation occurs;
- unacceptable risk emerges;
- critical control fails;
- material fairness deviation occurs;
- serious incident occurs;
- deployment causes unexpected behavior.
26.5 Rollback Validation
Rollback Tested: Evidence ID:27. Change Approval
27.1 Required Reviews
27.2 Approval Authority
Approval Authority: Authority Basis:27.3 Approval Decision
Decision:- Approved
- Approved with Conditions
- Deferred
- Rejected
- Suspended
28. Change Conditions
28.1 Condition Failure
Action if condition is not satisfied:29. Deployment Planning
29.1 Deployment Strategy
Strategy:- Full Deployment
- Phased Deployment
- Pilot
- Controlled Release
- Shadow Deployment
- Restricted Deployment
- Emergency Deployment
- Other
29.2 Deployment Scope
Initial Deployment Scope:29.3 Deployment Owner
Owner:29.4 Deployment Schedule
Planned Deployment Date:29.5 Deployment Dependencies
Dependencies:30. Deployment Readiness
30.1 Readiness Assessment
Deployment Readiness:- Ready
- Ready with Conditions
- Not Ready
30.2 Readiness Checklist
- Approval complete
- Conditions satisfied or formally accepted
- Required testing passed
- Critical controls operational
- Monitoring operational
- Rollback available where required
- Incident process ready
- Human oversight ready
- Security ready
- Privacy requirements addressed
- User training completed where required
- Evidence captured
31. Deployment Record
Deployment ID: Change ID: System Version Deployed: Deployment Date: Deployment Owner: Authorized By: Deployment Status:- Planned
- In Progress
- Completed
- Failed
- Rolled Back
32. Post-Deployment Validation
32.1 Validation Scope
Validation Scope:32.2 Validation Period
Period:32.3 Validation Indicators
32.4 Validation Conclusion
Conclusion:33. Enhanced Monitoring After Change
33.1 Enhanced Monitoring Required
Yes / No:33.2 Duration
Duration:33.3 Monitoring Owner
Owner:33.4 Exit Criteria
Exit Criteria:34. Change Closure
34.1 Closure Criteria
The change should not be closed until applicable criteria are satisfied.- Approved
- Deployment completed
- Post-deployment validation completed
- Monitoring completed
- No unresolved critical issue
- Required corrective actions completed
- Required conditions satisfied
- Evidence retained
- Documentation updated
- Residual risk assessed
- Approval conditions verified
34.2 Closure Decision
Change Status:- Closed
- Closed with Conditions
- Deferred
- Rejected
- Rolled Back
- Cancelled
34.3 Closure Authority
Closure Authority: Closure Date:35. Rollback Record
Complete when rollback occurs.35.1 Rollback Trigger
Reason for Rollback:35.2 Rollback Decision
Decision Authority: Decision Date:35.3 Previous Approved State
Restored Version: Restored Configuration:35.4 Rollback Validation
Validation Result:35.5 Post-Rollback Actions
Actions:36. Emergency Change
Complete where the change follows an authorized emergency process.36.1 Emergency Reason
Reason:36.2 Immediate Risk
Risk:36.3 Emergency Authority
Authority: Authority Basis:36.4 Emergency Controls
Controls:36.5 Retrospective Review
Retrospective Review Required: Review Date: Reviewer: Outcome:37. Change Evidence
37.1 Evidence Repository
Evidence Repository: Evidence Owner:37.2 Evidence Register
37.3 Evidence Completeness
Evidence Status:- Complete
- Substantially Complete
- Partially Complete
- Incomplete
37.4 Evidence Quality
Evidence Quality:- Strong
- Adequate
- Moderate
- Weak
- Insufficient
38. Change Traceability
The change should maintain links to relevant AIGO records.39. Change Traceability Model
40. Continual Improvement
40.1 Lessons Learned
Lessons Learned:40.2 Improvement Actions
41. Change Review and Approval
41.1 Prepared By
Name: Role: Date:41.2 Reviewed By
Name: Role: Date:41.3 Approved By
Name: Role: Date:41.4 Final Decision
Decision:- Approved
- Approved with Conditions
- Deferred
- Rejected
- Rolled Back
- Closed
42. Change Review Schedule
42.1 Post-Change Review
Review Frequency: Next Review Date: Review Owner:42.2 Triggered Review
Review should be considered after:- post-deployment failure;
- material incident;
- unexpected model behavior;
- monitoring threshold breach;
- control failure;
- residual-risk increase;
- supplier change;
- regulatory change.
43. Change History
44. Change Completion Checklist
- Change ID assigned
- AI System ID identified
- Change objective documented
- Change trigger identified
- Change description documented
- Change classification completed
- Scope defined
- Intended purpose reviewed
- Classification impact assessed
- Stakeholder impact assessed
- Business impact assessed
- Technical impact assessed
- Data impact assessed
- Model impact assessed
- Security impact assessed
- Privacy impact assessed
- Fairness impact assessed where applicable
- Human oversight impact assessed
- Risk assessment completed
- Controls assessed
- Monitoring impact assessed
- Incident history reviewed
- Assurance findings reviewed
- Third-party impact assessed where applicable
- Test plan approved
- Required testing completed
- Rollback capability assessed
- Approval completed
- Conditions recorded
- Deployment strategy approved
- Deployment readiness verified
- Deployment completed
- Post-deployment validation completed
- Enhanced monitoring completed where required
- Residual risk assessed
- Evidence retained
- Change formally closed
- Lessons learned recorded
- Related AIGO records linked
45. Template Usage Instructions
This template should be completed according to the organization’s approved AIGO AI Change Management Procedure. AI changes should be evaluated according to their potential governance impact rather than solely their technical size. A technically small change may still be a material AI change where it affects:- intended purpose;
- affected persons;
- model behavior;
- data;
- decision significance;
- classification;
- risk;
- controls;
- human oversight;
- security;
- privacy;
- fairness;
- monitoring;
- applicable requirements.
46. Template Governance
46.1 Template Owner
Template Owner:46.2 Template Review
Review Frequency: Next Review Date:46.3 Template Change Control
Changes to this template should be managed through the applicable AIGO document and change-management process. Material changes should consider their effect on:- AI Change Management Procedure;
- AI System Registration;
- AI System Profile;
- Classification;
- Risk Assessment;
- Control Assessment;
- Approval;
- Monitoring;
- Incident Management;
- Assurance;
- Risk Acceptance;
- Continuous Improvement;
- schemas;
- mappings;
- tools.
47. Document Control
48. Template Status
Document: AIGO — AI Change Management Template Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-TPL-011
Document Type: AI Change Management Template
This template provides the controlled structure for identifying, classifying, assessing, approving, testing, implementing, monitoring, validating, rolling back, closing, and improving changes to AI systems and their supporting governance environment.
49. End of Template
AIGO — AI Change Management Template Document ID:AIGO-TPL-011
Version: 0.1
Status: Draft
End of Template