AI AgentsComplianceChange Control
AI workflows change far more often than the procedures that describe them. Regulated companies need an agreed way to decide which changes require an SOP revision and retraining, and a way to enforce it.
Blackstone+Cullen recently published a guide to AI change management for mid-market companies that lack a large internal transformation office. One of its points deserves more attention than it usually gets. The firm describes its five pillars of change management as cyclical rather than sequential: as AI capabilities evolve and the organization learns, you revisit the vision, adjust governance and continue developing people. I agree with that framing, and I think it has a specific consequence for companies in regulated industries that general advice tends to skip. In a company with a quality system, every turn of that cycle lands on controlled documents and training records.
Most procedures in a regulated company were written for systems that change slowly. An ERP module or a document management system goes live, an SOP describes how people use it, and that SOP might be revised once a year or when the system is upgraded. An AI workflow behaves differently. Someone tunes the instructions the agent follows, the vendor releases a new model version, a confidence threshold gets adjusted, or the workflow is extended from one document type to another. Several of those changes alter what a human reviewer actually sees and decides, even when nobody thinks of them as process changes.
When that happens, the written procedure and the actual work drift apart. A reviewer's training record says they were trained on revision C of a work instruction, and revision C describes a screen, a set of exception categories and an escalation path that no longer match the system. In medical device, ISO 13485 expects documented procedures to be followed and personnel to be competent for the work they perform. Audits in financial services and manufacturing tend to probe the same question in different language: can you show that people were trained on the process as it runs today? A gap there is easy for an auditor to find and hard to explain after the fact.
The Blackstone+Cullen piece also notes that AI change requires closer collaboration between operations, IT, data and risk functions than earlier technology changes did. This is where that point gets concrete. The person adjusting the agent's configuration often sits in IT, on a data team or at the vendor, and may not know a work instruction exists. The person who owns the work instruction usually has no visibility into the configuration at all.
The practical fix is to sort AI workflow changes into categories before they happen and agree with quality on what each category requires. A useful dividing line is whether the change alters the human part of the task. If a change affects what the reviewer is shown, what they are asked to approve, which cases are routed to them or how they escalate, it should trigger a procedure revision and retraining. If the change is internal to the agent and the reviewer's task is unchanged, such as a new model version that passes the same regression tests, it may need a change record and test evidence but no new training.
Write that classification into the change control procedure itself, with worked examples, and have quality approve it once. The friction here is real. Document control cycles in many companies take weeks, and if every prompt adjustment waits on a full SOP revision, teams will either stop improving the workflow or start making changes without telling anyone. Both outcomes are worse than the drift you were trying to prevent. Pre-agreed categories let routine changes move quickly while the ones that affect people get the full review. A single question on the change request form, asking whether the change alters what a reviewer sees or does, catches most cases at the moment the change is proposed.
The second fix is to let the workflow check training status directly. If the system routing approval tasks knows which revision of the work instruction is current and which reviewers are trained on it, it can hold tasks for anyone who is behind. That turns a retraining requirement from a reminder email into an enforced control, and it gives you evidence an auditor can follow.
This depends on plumbing that many mid-market companies don't have yet. Training records often live in a spreadsheet matrix or a learning system that doesn't connect to anything else, and role changes reach it late. Laminar built a training and safety compliance system for Eastern Municipal Water District, a public utility, with mobile attendance capture and integration with its HR system. That system involved no AI, though it shows the kind of link between attendance records, job roles and the HR system of record that an AI workflow's retraining cycle relies on. If your training data can't answer "who is current on revision D right now" with a query, fix that before you add more AI workflows on top of it.
Dealing with a similar challenge?
We work with mid-market companies in regulated industries to build AI workflows that actually hold up.
Let's TalkSean Cummings
Founder of Laminar Consulting Services. Specializes in AI workflow automation for regulated industries — medical device, financial services, and complex logistics operations.
