{"slug":"model-release-and-change-management-gate","id":"AIPT-CTL-0017","title":"Model release and change-management gate","kind":"process","kind_label":"Process","purpose":"Makes every release, retraining and material change to an AI system pass through a documented decision that confirms the required assessments, tests and documentation are complete and current.\n","description":"A release checklist tied to the system's risk tier lists the artefacts that must exist and be current before go-live: risk and impact assessments, test reports, documentation, oversight design, notices, monitoring plan and, where relevant, conformity and registration records. A change-classification rule distinguishes routine updates from material changes that re-open the assessments. The gate is applied in the deployment pipeline where possible, with a human approver for higher tiers, and decisions, deferrals and conditions are recorded. Decommissioning follows the same path in reverse, with data, logs and documentation retained as required.\n","owner_role":"Release manager","frequency":"on_material_change","frequency_label":"At launch and on material change","risk_subdomains":["7.3","6.5"],"evidence":[{"type":"approval_record","title":"Release or change approval record","description":"Checklist outcome, approver, conditions and date for one release or material change."},{"type":"procedure","title":"Release and change-classification procedure","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 8.1; Annex A.6.2.5, A.6.1.3","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MANAGE 1.1, 2.3; GOVERN 1.7","note":null,"confidence_level":"medium"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 8.32 Change management","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","relationship":"satisfies","note":"The gate flags substantial modification, rebranding and repurposing and opens the provider duties.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider"},{"slug":"eu-ai-act-art-53-gpai-technical-and-downstream-documentation","title":"Providers of GPAI models must maintain technical documentation and inform downstream providers","relationship":"supports","note":"Release requires the documentation to be current.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation"},{"slug":"eu-ai-act-art-20-corrective-actions-and-information","title":"Providers must take corrective action and inform the supply chain about non-conforming high-risk AI","relationship":"supports","note":"Withdrawal, disabling and re-release pass through the gate.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information"},{"slug":"eu-ai-act-quality-management-system","title":"Operate a quality management system","relationship":"supports","note":"Design, release and change procedures within the system.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system"},{"slug":"us-california-sb-53-transparency-report","title":"Frontier developers must publish a transparency report before deploying a new frontier model","relationship":"supports","note":"Release is gated on the report being published.","confidence_level":"high","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report"}],"related_controls":["accuracy-robustness-security-testing","technical-documentation-and-model-cards","conformity-assessment-and-registration","ai-quality-management-system"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate","context_url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate.md"}