Model release and change-management gate
Makes every release, retraining and material change to an AI system pass through a documented decision that confirms the required assessments, tests and documentation are complete and current.
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 6 sections
- Duties satisfied
- 1
- done properly, does the work
- Duties supported
- 4
- contributes; the duty needs more
- Jurisdictions
- 2
- Evidence items
- 2
In brief
Model release and change-management gate is a process, owned by the release manager and run at launch and on every material change. 5 recorded duties in 2 jurisdictions rely on it, and it satisfies 1 of them outright. It produces 2 kinds of evidence an auditor can ask for.
How is it implemented?
A release checklist tied to the system's risk tier lists the artefacts that must exist and be current before go-live: risk and impact assessments, test reports, documentation, oversight design, notices, monitoring plan and, where relevant, conformity and registration records. A change-classification rule distinguishes routine updates from material changes that re-open the assessments. The gate is applied in the deployment pipeline where possible, with a human approver for higher tiers, and decisions, deferrals and conditions are recorded. Decommissioning follows the same path in reverse, with data, logs and documentation retained as required.
Which legal duties does it serve?
Satisfies means the control, operated properly, does the work the duty asks for. Supports means it contributes but the duty needs more. The official text decides; open it before relying on either.
European Union 4 duties
-
satisfies Legal requirementDeployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI
EU AI Act · Article 25(1) and 25(2) · applies from 2 Dec 2027
The gate flags substantial modification, rebranding and repurposing and opens the provider duties.
-
supports Legal requirementProviders of GPAI models must maintain technical documentation and inform downstream providers
EU AI Act · Article 53(1)(a) and 53(1)(b); Annexes XI and XII · applies from 2 Aug 2025
Release requires the documentation to be current.
-
supports Legal requirementProviders must take corrective action and inform the supply chain about non-conforming high-risk AI
EU AI Act · Article 20 · applies from 2 Dec 2027
Withdrawal, disabling and re-release pass through the gate.
-
supports Legal requirementOperate a quality management system
EU AI Act · Article 17 · applies from 2 Dec 2027
Design, release and change procedures within the system.
California (United States) 1 duty
-
supports Legal requirement confidence highFrontier developers must publish a transparency report before deploying a new frontier model
California SB 53 · Business and Professions Code Section 22757.12 (as added by SB 53) · applies from 1 Jan 2026
Release is gated on the report being published.
What evidence shows it is operating?
| Evidence | Type | What it shows |
|---|---|---|
| Release or change approval record | Approval or sign-off record | Checklist outcome, approver, conditions and date for one release or material change. |
| Release and change-classification procedure | Procedure or standard operating process |
Owner: Release manager. Frequency: at launch and on material change.
Which risks does it address?
Subdomains of the MIT AI Risk Repository, with the incidents the AI Incident Database has recorded under each. Counts are live; they say how often a risk has materialised, not how well this control prevents it.
- 7.3 Lack of capability or robustness AI system safety, failures, & limitations305 incidents · 126 risk entries
- 6.5 Governance failure Socioeconomic & Environmental3 incidents · 61 risk entries
Which standards clauses does it correspond to?
Clause numbers only. A reference means the standard asks for overlapping work, so evidence may be reusable; it never means the standard discharges a legal duty.
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001 | Clause 8.1; Annex A.6.2.5, A.6.1.3 | medium | |
| NIST AI RMF | MANAGE 1.1, 2.3; GOVERN 1.7 | medium | |
| ISO/IEC 27001 | Annex A 8.32 Change management | medium |
Cite this record
AIPolicyTracker (2026). “Model release and change-management gate” [AIPT-CTL-0017, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-CTL-0017 (accessed 8 November 2026). Data licensed CC BY 4.0.
Permanent id AIPT-CTL-0017: it never changes or gets reused, and its address keeps working if this page moves.
BibTeX
@misc{aipolicytracker2026_modelreleaseandchangeman,
author = {{AIPolicyTracker}},
title = {{Model release and change-management gate}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/controls/model-release-and-change-management-gate}},
url = {https://aipolicytracker.org/controls/model-release-and-change-management-gate},
urldate = {2026-11-08},
note = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
Frequently asked questions
Which legal duties does "Model release and change-management gate" satisfy?
It is recorded as satisfying 1 and supporting 4 duties across European Union and California (United States). A mapping means the control, operated properly, does the work the duty asks for; the official text decides whether it is enough.
What evidence shows this control is operating?
Release or change approval record and Release and change-classification procedure. Owner: Release manager. Frequency: at launch and on material change.