AI GovernanceChange ManagementExecutive Sponsorship
AI change management works best as a recurring cycle, and in a regulated company every lap of that cycle produces controlled changes. The simplest way to keep up is to run the AI review inside the management reviews, system reviews and controls testing you already have.
Blackstone+Cullen recently published a guide to AI change management for mid-market companies that lack a large internal transformation office. One point in it deserves more attention than it usually gets. The firm describes its five pillars of change management as cyclical rather than sequential, and says that as AI capabilities evolve and the organization learns, you revisit the vision, adjust governance and continue developing people. I agree with that framing. For a company in a regulated industry, it raises a practical question: when the cycle comes around again, which existing process carries it, and where does the record end up?
In a regulated company, adjusting the governance of an AI workflow is a controlled change. A medical device manufacturer that changes how an AI agent drafts complaint summaries has changed a quality process. A lender that adjusts the thresholds an agent uses to route applications for human review has changed a credit process. Auditors and examiners expect both changes to be assessed, approved and documented before they take effect.
That means every lap of the cycle Blackstone+Cullen describes will generate change requests. If nobody planned for that volume, one of two things happens. The review stalls in a change control queue that was sized for occasional software releases, or the adjustments happen informally and the documentation falls behind actual practice. The second outcome is worse. An inspector who finds an AI workflow operating differently from its approved procedure will treat it as an uncontrolled change, whatever the intent behind it.
Some of the changes will not originate with you at all. AI vendors update their underlying models on their own release schedules. A review cycle for a regulated company has to account for changes it did not choose and may only learn about from a release note.
Most regulated mid-market companies already hold recurring reviews with defined owners, agendas and records. Medical device makers hold the management review their quality system requires. Companies with computerized systems in GxP scope perform periodic reviews of those systems. Public companies test key financial controls every year for Sarbanes-Oxley. Banks that follow the Federal Reserve's SR 11-7 guidance on model risk management already perform ongoing monitoring and periodic validation of their models.
I think the AI review cycle belongs inside these existing reviews for the first year or two, rather than in a new standing AI committee. The people who have to sign off on changes already attend them, and their output already flows into records that auditors know how to read. A company without a transformation office is also unlikely to have spare capacity to staff another recurring meeting. Blackstone+Cullen notes that AI change management requires closer collaboration between operations, IT, data and risk functions than past technology changes did. That collaboration is easier to sustain when it has a fixed place on a calendar the organization already keeps.
This carries its own friction. Those reviews were designed for other purposes and their agendas are already full. If AI shows up as item twelve on a management review agenda, it will get ten minutes and a nod. The AI portion needs its own defined scope, its own inputs and a protected block of time.
A review that ends in general discussion leaves change control with nothing to act on. For each AI workflow in scope, the review should end with one of three recorded decisions: keep the workflow as approved, open a change request for a specific adjustment, or begin retiring it. That decision, with its rationale, is the evidence that the cycle actually ran.
The inputs should be agreed before the first meeting so the review does not depend on whoever happens to bring data. Useful inputs include the override rate (how often human reviewers rejected or edited the agent's output), deviations, exceptions or complaints traced to the workflow, vendor model or platform updates since the last review, changes to upstream processes or data sources, and regulatory changes affecting the work. The people side belongs here too. Check whether training records reflect the workflow as it currently runs and whether new staff have been trained on the current version.
A fixed schedule alone is too slow for some events. Define triggers that pull a review forward, such as a vendor announcing a model version change, the override rate crossing an agreed threshold, a deviation linked to agent output, or a revision to the procedure the agent supports. Write those triggers into the procedure that governs each workflow, so the person who notices the event knows they are expected to call the review.
Dealing with a similar challenge?
We work with mid-market companies in regulated industries to build AI workflows that actually hold up.
Let's TalkSean Cummings
Founder of Laminar Consulting Services. Specializes in AI workflow automation for regulated industries — medical device, financial services, and complex logistics operations.
