Which legal duties does "Model release and change-management gate" satisfy?

It is recorded as satisfying 1 and supporting 4 duties across European Union and California (United States). A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.

What evidence shows this control is operating?

Release or change approval record and Release and change-classification procedure. Owner: Release manager. Frequency: at launch and on material change.

Process Owner: Release manager At launch and on material change

Model release and change-management gate

Makes every release, retraining and material change to an AI system pass through a documented decision that confirms the required assessments, tests and documentation are complete and current.

Source-linked Context file

Duties satisfied: 1; done properly, does the work
Duties supported: 4; contributes; the duty needs more
Jurisdictions: 2
Evidence items: 2

How is it implemented?

A release checklist tied to the system's risk tier lists the artefacts that must exist and be current before go-live: risk and impact assessments, test reports, documentation, oversight design, notices, monitoring plan and, where relevant, conformity and registration records. A change-classification rule distinguishes routine updates from material changes that re-open the assessments. The gate is applied in the deployment pipeline where possible, with a human approver for higher tiers, and decisions, deferrals and conditions are recorded. Decommissioning follows the same path in reverse, with data, logs and documentation retained as required.

Which legal duties does it serve?

Satisfies means the control, operated properly, does the work the duty asks for. Supports means it contributes but the duty needs more. The official text decides; open it before relying on either.

European Union 4 duties

satisfies Legal requirement
Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI
EU AI Act · Article 25(1) and 25(2) · applies from 2 Aug 2026

The gate flags substantial modification, rebranding and repurposing and opens the provider duties.
supports Legal requirement
Operate a quality management system
EU AI Act · Article 17 · applies from 2 Aug 2026

Design, release and change procedures within the system.
supports Legal requirement
Providers must take corrective action and inform the supply chain about non-conforming high-risk AI
EU AI Act · Article 20 · applies from 2 Aug 2026

Withdrawal, disabling and re-release pass through the gate.
supports Legal requirement
Providers of GPAI models must maintain technical documentation and inform downstream providers
EU AI Act · Article 53(1)(a) and 53(1)(b); Annexes XI and XII · applies from 2 Aug 2025

Release requires the documentation to be current.

California (United States) 1 duty

supports Legal requirement confidence high
Frontier developers must publish a transparency report before deploying a new frontier model
California SB 53 · Business and Professions Code Section 22757.12 (as added by SB 53) · applies from 1 Jan 2026

Release is gated on the report being published.

What evidence shows it is operating?

Evidence this control produces
Evidence	Type	What it shows
Release or change approval record	Approval or sign-off record	Checklist outcome, approver, conditions and date for one release or material change.
Release and change-classification procedure	Procedure or standard operating process

Owner: Release manager. Frequency: at launch and on material change.

Which risks does it address?

Subdomains of the MIT AI Risk Repository, with the incidents the AI Incident Database has recorded under each. Counts are live; they say how often a risk has materialised, not how well this control prevents it.

7.3 Lack of capability or robustness AI system safety, failures, & limitations305 incidents · 126 risk entries
6.5 Governance failure Socioeconomic & Environmental3 incidents · 61 risk entries

Which standards clauses does it correspond to?

Clause numbers only. A reference means the standard asks for overlapping work, so evidence may be reusable; it never means the standard discharges a legal duty.

Framework references
Framework	Reference	Confidence
ISO/IEC 42001	Clause 8.1; Annex A.6.2.5, A.6.1.3	medium
NIST AI RMF	MANAGE 1.1, 2.3; GOVERN 1.7	medium
ISO/IEC 27001	Annex A 8.32 Change management	medium

Cite this record

AIPolicyTracker (2026). “Model release and change-management gate”. https://aipolicytracker.org/controls/model-release-and-change-management-gate (accessed 24 September 2026). Data licensed CC BY 4.0.

Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.

Governance card

Kind: Process
Owner: Release manager
Frequency: At launch and on material change
Binding duties: 5 of 5
Review status: Pending human review

Confirm which of the duties above reach you (applicability check).
Assign the owner and the frequency.
Operate the control and keep the evidence listed.
Re-check when a duty changes (change log).

Related controls

Accuracy, robustness, fairness and security testing Technical measure
Conformity assessment, declaration and registration Process
Quality management system for AI development and supply Policy
Technical documentation, model cards and instructions for use Process

Report a correction How we verify

Run this control as a tracked task with Certifyi, a separate compliance execution platform. AIPolicyTracker itself stays open and independent.

Frequently asked questions

Which legal duties does "Model release and change-management gate" satisfy?: It is recorded as satisfying 1 and supporting 4 duties across European Union and California (United States). A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.
What evidence shows this control is operating?: Release or change approval record and Release and change-classification procedure. Owner: Release manager. Frequency: at launch and on material change.