MediumChange Mgmt◐Demonstrated
Model & version change-management gaps
Governance, Accountability & ComplianceDescription
Untracked changes to models, prompts, or providers enter production without testing or rollback.
Example scenario
A prompt edit is pushed straight to production and silently breaks a compliance check.
Real-world evidence◐Demonstrated
Regulators (OCC, EBA, MAS) have published guidance on third-party AI risk and supervisory reviews have flagged inadequate vendor oversight, but confirmed enforcement actions or material incidents causally attributable specifically to third-party AI non-management are documented in research and guidance rather than confirmed production enforcement at scale.
Primary mitigations
- Versioned prompts/models
- change approval
- regression gates
- rollback plans
- provider-pinning.
Detection signals
Change-audit logs; unapproved-change detection; rollback drills.
Mitigating controls
6 Non-agentic controls
ZYC-SYSG-001Non-Agentic
Drift Resilience
System Governance
ZYC-ACCT-001Non-Agentic
Human-in-the-Loop
Accountability & Oversight
ZYC-LEGAL-001Non-Agentic
AI Regulation Compliance
Legal Compliance
ZYC-AUDIT-001Non-Agentic
Extraction Failure Logging
Auditability
ZYC-SYSG-002Non-Agentic
Model Card Currency
System Governance
ZYC-SYSG-005Non-Agentic
Change Governance
System Governance