Change Management: AI Systems Don't Sit Still

Traditional software changes when someone ships a release. AI systems change far more often: new training data, retrained models, updated vendor APIs, shifting user behavior, drifting real-world conditions. Your AI next quarter may behave differently from your AI today, with nobody pressing a button.

ISO 42001 expects you to manage this. Changes to the AI system — planned or otherwise — should be reviewed for their impact on risks, objectives, and compliance before they take effect. In plain English: know what changed, think about what it means, and approve it like you mean it.

This does not require freezing innovation. It requires a change habit proportional to the stakes. A new chatbot persona gets a light review. A retrained credit model gets a serious one. The point is that the review happens at all, on purpose, before the change reaches the people it affects.

Build three habits. Inventory your AI systems so you know what exists. Track changes to each one — versions, data, vendors. And tie significant changes back to your risk assessment: does this change what could go wrong?

AI does not sit still. Your governance cannot either. Manage the motion, and the motion stops managing you.

I explain frameworks; I don't give legal counsel.